ESG ratings: Final regime

Policy Statement
PS26/22
ESG (Environmental, Social,
Governance) ratings: Final regime
November 2026

This relates to
Consultation Paper 25/34 which is available on our website at www.fca.org.uk/publications Sign up for our news and publications alerts See all our latest press releases, consultations and speeches. All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 6087

Contents
Chapter 1 Summary Page 4
Chapter 2 Baseline standards Page 7
Chapter 3 Transparency Page 10
Chapter 4 Governance and systems and controls Page 17
Chapter 5 Conflicts of interest Page 25
Chapter 6 Stakeholder engagement and complaints Page 31
Chapter 7 Senior Managers and Certification Regime Page 39
Chapter 8 Perimeter guidance Page 41
Chapter 9 Authorisation Page 44
Chapter 10 After authorisation Page 49
Chapter 11 Cost benefit analysis (CBA) . . . . . . . . . . . . . . . . . . . . . . . . . . Page 53
Annex 1 Regime summary and changes from the original proposals . . . . . . . Page 64
Annex 2 List of respondents . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Page 67
Annex 3 Measuring success Page 69
Annex 4 Updated Compatibility Statement Page 71
Annex 5 Abbreviations used in this paper Page 73
Appendix 1 Made rules (legal instrument)

Chapter 1
Summary
Our final rules aim to help the ESG ratings market work well.
1.1 ESG ratings play a significant role in decision‑making for many institutional investors.
Global spending on ESG ratings and data is estimated to have more than doubled between 2021 and 2025 (paywalled).
1.2 This Policy Statement (PS) contains our final rules and guidance for ESG rating providers.
It reflects feedback from our consultation paper (CP) (CP25/34) published in December 2025, following government legislation to bring ESG ratings into regulation.
1.3 Currently, users can find it difficult to understand how ratings are produced, compare
different products or assess potential conflicts of interest. Our final rules are designed to make this market work better. They aim to improve transparency and reliability, strengthening accountability and giving users greater confidence, while promoting competition and innovation.
1.4 There is clear support for bringing ESG ratings into FCA regulation. While there can be
differing views on ESG investing, these products are widely used and influence how capital is allocated. We also recognise that there are varied approaches to assessing ESG factors. We do not prescribe a particular approach and we are supportive of methodological diversity. In developing the final regime, we engaged extensively with firms, users, rated companies, industry bodies and other stakeholders.
1.5 We received 90 consultation responses from a wide range of stakeholders. Feedback
supported our principles‑based approach and intended outcomes, while emphasising support for proportionality and EU alignment.
1.6 Respondents broadly supported our proposal to apply baseline FCA standards to
ESG rating providers. They also supported our governance, systems and controls and conflicts of interest‑related proposals. We received the most feedback on our transparency and stakeholder engagement proposals, with respondents giving a range of views.
1.7 We have maintained most of the proposals we consulted on and have made limited
changes. Our main updates are to the transparency and stakeholder engagement proposals, to improve clarity, proportionality and support practical implementation. In other areas, we have provided further clarification in this PS, including some case study examples for Conflicts of Interest (Chapter 5). See Annex 1 for a summary of the regime and key changes.

1.8 We have updated our cost benefit analysis to reflect these policy changes (Chapter 11).
We believe these changes do not impact the compatibility statement in CP25/34. Our final approach remains consistent with international standards, including the International Organization of Securities Commissions (IOSCO) recommendations and rules in other jurisdictions such as the EU. In creating the regime, we have sought to avoid unnecessary duplication and operational burden.
1.9 A trusted, well‑regulated and internationally aligned ESG ratings market will strengthen
confidence in the wider UK financial market. It will help users to better assess sustainability‑related risks and opportunities. This will support decision‑making, risk management and market resilience. These benefits will contribute to our secondary international competitiveness and growth objective, helping to maintain the UK’s position as a leading global hub for sustainable finance. This is in line with the Treasury’s recommendations to us in its 2024 remit letter.
1.10 The International Capital Market Association (ICMA) Code of Conduct will continue
to operate alongside the regime. It will remain relevant for ESG data providers that fall outside the scope of regulation. As an internationally recognised standard, it will also continue to support good practice globally. Terminology in this Policy Statement
1.11 In this PS, we have simplified certain terms from our final rules (Appendix 1) for ease of
understanding. For example, we use the term ‘rated entity’ rather than ‘notifiable person’ when referring to the subject of an ESG rating or a directly related party. Firms should refer to our final rules for the precise meaning and application of these defined terms.
1.12 We have amended the definition of notifiable person since consultation. As a result,
there is less overlap between the categories of ESG rating users and notifiable persons. But a person may still fall within more than one category under our rules. Firms should refer to our final rules when considering all requirements that apply. Next steps What you need to do next
1.13 From 29 June 2028, all ESG rating providers in scope will need to be FCA‑authorised to
carry out ESG ratings activity in the UK. Beyond this date, firms that carry on ESG ratings activity without the required authorisation will be in breach of the general prohibition under Financial Services and Markets Act 2000 (FSMA) and will be committing a criminal offence.

1.14 All ESG rating providers need to:

Review this PS to understand the future regime they will be subject to.
Consider our Perimeter Guidance (PERG) alongside the Statutory Instrument (SI) to
assess whether the products they provide fall within the scope of the regime.
Prepare for the application process ahead of the authorisation gateway opening
on 24 June 2027. Our pre‑application support service (PASS) will be available from February 2027 to support firms with their applications.
1.15 Users of ESG ratings, rated companies and other affected or interested
stakeholders should read this PS to understand the new regime. What we will do next
1.16 We will prepare for implementation, ahead of the regime going live on 29 June 2028.
For full timelines, see below.
Figure 1: ESG Ratings Roadmap
ESG Ratings Roadmap
October
Statutory
Instrument laid
December
Consultation
Paper published
31 March
Consultation closed
December
Firm familiarisation and ongoing support
3 November
Policy
Statement and rules published
February
Pre-Application
Support
Service available
24 June
Authorisation gateway opens
29 June
Regime goes live

Chapter 2
Baseline standards
High‑level standards and the Consumer Duty
2.1 We proposed applying relevant FCA Handbook requirements to ESG rating
providers, including:

Threshold Conditions (TC), described in guidance in COND.
Principles for Businesses (PRIN), excluding the Consumer Duty (the Duty).
Relevant provisions of the Systems and Controls sourcebook (SYSC), including
requirements relating to the Senior Managers and Certification Regime (SM&CR).
General Provisions (GEN).
The financial crime provisions of SYSC 6 and the Financial Crime Guide (FCG).
2.2 We also proposed not to introduce bespoke prudential requirements for ESG
rating providers.
Summary of final approach for baseline standards
2.3 We received broad support for our proposals and are proceeding as consulted on.
Feedback received and our response
Baseline standards
2.4 Most respondents agreed with applying relevant FCA Handbook requirements to
provide an appropriate regulatory framework. Some emphasised the importance of applying the standards proportionately and the need to support competition, innovation and market diversity.
2.5 There were mixed views on our proposal to apply SYSC 8.1.1R (outsourcing
requirements) to ESG rating providers as a rule rather than guidance. Some respondents supported the proposal as promoting accountability for outsourced activities. Others preferred applying it as guidance, to support proportionality and operational flexibility, particularly for firms with global group structures.
2.6 A small number disagreed with our proposal not to permit ESG rating providers to treat
their clients as ‘eligible counterparties’ for the purposes of PRIN 3.4.1R and PRIN 3.4.2R.
2.7 We respond to feedback on SM&CR in Chapter 7.

Our response
Many of the baseline requirements, including within SYSC, are designed to be applied proportionately, reflecting the nature, scale and complexity of a firm’s activities. We will take this into account at the authorisation gateway and through ongoing supervision (see Chapters 9 and 10). We recognise the importance of supporting competition and innovation, including the role played by smaller and specialist providers, and have designed the regime to work for the range of business models in the market. We are proceeding to apply SYSC 8.1.1R (outsourcing requirements) as a rule. It is important that firms maintain effective control over critical functions and the integrity of the rating process. In Chapter 4 we explain how this requirement interacts with the outsourcing requirements in our sourcebook to allow for operational flexibility while ensuring that the UK authorised firm remains effectively accountable. We are also proceeding with our proposal that ESG rating providers should not be permitted to treat clients as eligible counterparties. The regime is designed to deal with the risk of harm in the market. It is appropriate to have a consistent baseline of standards for rating providers serving all types of clients, whether these are sophisticated users or authorised firms, who will benefit from greater transparency and more reliable ratings. The Consumer Duty
2.8 Most respondents agreed with our proposal not to apply the Duty to ESG rating
providers. Some noted that ESG rating providers do not typically have a material impact on retail consumer outcomes and applying the Duty could create uncertainty regarding the responsibilities of rating providers towards end users of ratings information.
2.9 Several respondents suggested that firms should consider the principles underpinning
the Duty when communicating to users of ESG ratings, including those in the distribution chain.
2.10 A small number suggested that we should monitor developments in the market,
including retail use of ESG ratings, and keep the position under review.

Our response
We will not apply the Duty to ESG rating providers. This is a proportionate approach, given the wholesale nature of the market. However, our framework includes Duty‑aligned measures. For example, our transparency rules (Chapter 3) require providers to make disclosures clear and easy to understand for their intended audience. This may include firms in the distribution chain that are subject to the Duty. Responsibility for complying with the Duty remains with firms that are within its scope. We will continue to monitor developments in the ESG ratings market, including how ESG ratings are used by firms and consumers.

Chapter 3
Transparency
3.1 In our consultation we proposed a transparency framework to help users and rated
entities understand ESG ratings. Its 3 main elements were:

Minimum public disclosures about ESG rating providers and products.
Additional disclosures for direct users and rated entities, including product and
individual rating‑level information.
General expectations on how disclosures should be provided, including that they
should be accessible, clear, fair and not misleading.
3.2 We also proposed requirements on onward sharing, notification of material
methodology changes and protection for trade secrets.
Summary of final approach for transparency
3.3 We are proceeding with a tiered transparency framework. The framework comprises
public disclosures and additional disclosures for direct users and, on request, for rated entities. This is largely as consulted on, but with some key updates informed by the feedback to improve clarity and proportionality. We have:
Added guidance and made targeted changes to the transparency requirements.
Reduced regulatory burden by allowing certain information to be disclosed at
product-level, rather than individual rating-level.
Moved to an on‑demand approach for disclosures to rated entities.

Figure 2: Summary of what providers need to create and for which audience
Methodology, objective, coverage and rated universe Data approach, limitations, engagement approach Public Disclosures Everyone Trade-secret protection may apply where the conditions are met All disclosures must be: easily accessible • clearly presented • accurate • fair • not misleading ESG ratings transparency: what providers share – and who gets it Direct users Notifi cation and Rated entities Engagement Notifi cation (Minimum 2 working days before publication) Underlying data, factual correction, feedback and complaints Advance notifi cation of material methodology changes What the provider shares Who receives it Detailed Disclosures Product‑level detail Individual rating detail where applicable Direct users automatically Rated entities on request
3.4 Our transparency framework is designed to meet the needs of different audiences:

Direct users, who receive ESG ratings directly from a provider, require detailed
information about the rating products and ratings they use.
Indirect and prospective users benefit from public disclosures that help them
understand and compare ESG rating products.
Rated entities require information to help them understand how they have been
assessed and engage effectively with providers. This includes advance notification of new ratings and detailed information on demand.
3.5 This summary is not exhaustive. ESG 6.4 in Appendix 1 sets out the final rules and
guidance in full.
Feedback received and our response
3.6 Feedback was extensive and mixed. Respondents generally supported improving
transparency in the ESG ratings market. However, views differed on what should be disclosed, to whom and in what level of detail.
3.7 Key themes included:
Calls for disclosures beyond what we proposed, including on methodology, data
estimation, data verification and artificial intelligence (AI).
Differing views on what should be made public and what should be provided only to
direct users and rated entities.
Concerns about duplication and operational challenges, particularly where the same
information applies across many ratings.
Requests for a more proportionate and flexible approach, reflecting concerns about
implementation costs, operational complexity and intellectual property.
3.8 We have considered this feedback and have made targeted changes to the transparency
requirements. We summarise the key themes in more detail and our response below. Minimum public disclosures
3.9 Respondents broadly supported the minimum public disclosures. Many, including
users, rated entities and providers, suggested additions, including on data quality and estimates, AI use and oversight, review practices, known limitations and treatment of controversies. Some respondents suggested additional disclosures found in the EU regime, such as methodology versioning and alignment with international standards, and providers’ fee structures.
3.10 Some respondents were concerned that public disclosures could become too lengthy
or technical. Others feared excessive disclosure of proprietary information, such as detailed weightings or machine‑learning models. Our response We have updated the public disclosure requirements to more clearly reflect our policy intent and the level of detail expected. Changes and clarifications We have made targeted additions to the public disclosure requirements. These include:
policies and processes on data quality and verification, and the use of
data estimates
ESG rating review frequency
methodology versioning
the factors relevant to material methodology changes
the general impact of the last material methodology change
We have also clarified our expectations for disclosures on:
peer groups
rated items coverage
approach to engagement
AI oversight
notification process for material methodology changes
material limitations of an ESG rating product

To clarify our expectations in line with intended policy outcomes, we have updated certain methodology disclosure requirements relating to models, factors, inputs and data. We do not require public disclosure of precise weightings or training data. Firms may also rely on the trade secrets exemption where the relevant conditions are met. Our methodology disclosure requirements already capture, where relevant, how controversies or similar events are reflected in ESG ratings. Length and technicality of disclosures Under our rules, firms should consider what information could reasonably be expected to help recipients understand the disclosures. We expect firms to refer to this guidance when preparing disclosures for their intended recipients. As set out under ‘General expectations’ below, the disclosures must also be accessible, clearly presented, accurate, fair and not misleading. Disclosures to ESG rating users and rated entities
3.11 Many respondents, including users, rated entities and some providers, supported
detailed disclosures to help users and rated entities understand how ESG ratings are produced and should be interpreted. Some respondents requested additional information on data sources, estimated data, peer groups and rating changes.
3.12 In contrast, some ESG rating providers were concerned disclosures could be overly
granular, duplicative or difficult to operationalise, particularly for per‑rating or per‑data‑point disclosure at scale. Views were mixed on certain areas, including unresolved factual challenges and the expected timeframe for the next review of an ESG rating. Some respondents considered these useful, while others questioned their usefulness or feasibility. Our response We have refined our approach to disclosures for ESG rating users and rated entities. Changes and clarifications We have added specific disclosure requirements for peer groups and for what firms consider to be a material change to their ESG rating or its data. We have also amended certain disclosure requirements. At rating‑level, we have clarified that firms must only disclose the data that materially influence an ESG rating, not all underlying data. At product‑level, we now require a detailed rather than full explanation of the methodology.

We have clarified our expectations on the level of detail expected regarding inherited ratings, main data, data sources, estimated and missing data, and material rating changes. We have removed the proposed disclosures of unresolved factual challenges and the expected timeframe for the next rating review. This will reduce operational burden while maintaining the overall policy outcomes we are targeting. Disclosures at rating-level We have introduced guidance clarifying that rating‑level disclosures can be provided at product-level where they apply across that entire product. Rating‑level disclosures are still required where information is specific to an individual rating. We have also clarified that firms do not need to produce separate disclosure documents where the rating‑level information is already included within the ESG rating output. For example, this information may be incorporated into existing reports, scorecards, data feeds or rating platforms. These changes will reduce operational burden while maintaining our intended policy outcome. Rated entities’ access to non‑public disclosures
3.13 Several respondents, particularly rated entities, explicitly supported mandatory standard
disclosures to help rated entities understand ratings, identify data issues and engage effectively with providers. Some also called for more detailed information on how ratings were determined, including the specific data and methodologies used.
3.14 In contrast, some ESG rating providers argued that providing detailed disclosures and
notifications to rated entities would create significant operational burden, particularly across large coverage universes and where contact details for rated entities may not be readily available. Our response We have amended our approach. Rated entities that are not ESG rating users will be entitled to receive additional detailed disclosures upon request rather than by default. Providers must make clear how rated entities can request those disclosures both publicly and when notifying them that they plan to make available a new ESG rating. Where a rated entity has made a request, providers may choose to facilitate ongoing access to future disclosures, for example, through an opt‑in mechanism or access to a portal.

We consider this more proportionate than requiring providers to provide detailed disclosures to all rated entities automatically. It gives rated entities access to the information when they want it and reflects that not all rated entities will want detailed disclosures from all providers. Rated entities will also continue to benefit from other communication elements of the regime, including advance notification of new ratings, access to underlying data and a factual correction process. We explain these requirements in Chapter 6. Onward sharing
3.15 Some respondents supported our proposal on onward information sharing. They
considered it important that persons accessing ESG ratings through intermediaries, such as investment platforms, should be able to access information that helps them understand those ratings.
3.16 Some ESG rating providers, as well as some trade bodies, raised concerns relating to
licensing restrictions and intellectual property. Some were also concerned that providers could be held responsible for how disclosures were subsequently shared, withheld or presented by third parties. Our response We are retaining the core onward sharing requirement, with targeted refinements. If a provider allows an ESG rating user to share the rating onward to a third party, that user should also be able to pass on relevant disclosures. Providers may either allow the ESG rating user to pass on the disclosures or provide those disclosures directly to the third party. We have clarified that firms are not expected to share information subject to third‑party restrictions. Firms may also rely on the trade secrets exemption where its conditions are met. We intend the onward sharing requirement to support understanding of shared ESG ratings rather than unrestricted reuse or redistribution. Our rules do not make providers responsible for how disclosures are subsequently shared, withheld or presented by third parties.

General expectations
3.17 Most respondents supported expectations that disclosures should be accessible, clearly
presented, accurate, fair and not misleading. Some respondents, particularly users and trade bodies, requested more guidance on format, layering, standardisation or templates. Our response We are proceeding with the approach consulted on. We allow firms flexibility in how they organise and present disclosures, rather than prescribing a standardised format or template. Trade secrets/intellectual property
3.18 Protection of intellectual property and trade secrets was a recurring theme from many
ESG rating providers and some trade bodies. Some respondents were concerned detailed disclosure requirements could unduly expose proprietary methodologies, models or other commercially sensitive information. Our response We have retained the trade secrets exemption. We have also made a burden‑reducing adjustment so firms do not need to explain why the relevant information constitutes a trade secret. Where a firm relies on the exemption, it must still make clear which information has not been disclosed on that basis. We do not expect firms to provide explanations that undermine the protection the exemption is intended to provide.

Chapter 4
Governance and systems and controls
4.1 We proposed rules to promote appropriate governance arrangements and systems and
controls across the ESG ratings process. We proposed rating providers:

Have robust governance arrangements proportionate to their size and complexity.
Keep full operational responsibility over the ESG ratings process, including
outsourced functions.
Have an appropriate UK presence to support effective oversight and accountability.
Implement systems and controls that ensure ratings are based on up‑to‑date
information and consistently apply methodologies.
Establish appropriate quality assurance processes and maintain internal records.
Make sure personnel producing ESG ratings are competent, professional and act
with integrity.
Summary of final approach for governance and systems and controls
4.2 We have retained our governance rules we consulted on. For systems and controls, we
have made targeted refinements to reduce operational burden. Providers must keep records that will enable them to explain and evidence how an ESG rating was produced and how the final outcome was determined, rather than reproduce the rating. Providers must also give users advance notice of material changes to methodologies, but they will not be required to provide advance notice to rated entities. Governance: feedback received and our response
4.3 Respondents generally supported the proposed governance approach. We received
mixed feedback on elements of our proposals. We have considered this feedback, and the responses below provide additional detail on how providers can meet the requirements in practice and how we intend to apply the framework. UK presence and operational responsibility
4.4 Several respondents, including both large and small providers, expressed concerns
about a ‘sufficient UK presence’ and asked how this would apply in practice. Smaller, specialist providers and trade bodies emphasised concerns regarding barriers to entry and disproportionality. A few larger global providers were concerned about the cost of duplicating or relocating functions to the UK. A few other respondents sought confirmation that this did not require all ESG rating activities to be performed in the UK.

4.5 A number of respondents expressly supported our proposal to require the authorised
firm to retain responsibility for the ESG rating process. However, several wanted further clarity about what ‘operational responsibility and control’ means in practice given the breadth of the ESG rating process. They asked how the requirement would apply in global group structures, outsourced arrangements and business models relying on external methodologies, datasets or shared services.
4.6 Several other respondents asked whether providers would need authority to override
group‑level methodologies or decisions taken elsewhere within their organisation, and what level of involvement in governance arrangements would be sufficient to satisfy the requirement. Our response We are proceeding as consulted on. It is important that firms have a clear point of accountability in the UK to support effective supervision and engagement. This does not require firms to locate all elements of the ESG rating process, operational functions or all senior personnel in the UK. Rather, firms should make sure they have sufficient senior management presence, oversight capability, and access to relevant information. This should be appropriate to their size, scale and complexity and allow them to manage regulatory obligations effectively and retain ultimate decision‑making responsibility. Our approach to governance, particularly accountability, is linked with the application of SM&CR, as set out in Chapter 7. We have sought to provide flexibility for firms to use existing group governance and operational arrangements where appropriate. The authorised firm must retain responsibility for the ESG ratings it provides in the UK and be able to require changes to any part of the ESG ratings process. This includes exercising effective oversight, challenge and escalation across the ESG rating process. For instance, ensuring that methodologies and processes comply with UK regulatory requirements. Providers must also be able to show they have sufficient authority and involvement in governance arrangements to identify, assess and address risks related to ESG rating activities. This includes where functions are performed elsewhere within group structures. We will assess firms’ authorisation applications in line with Our Approach to International Firms. We encourage firms to familiarise themselves with this approach. Where appropriate, firms should use the pre‑application support service (PASS) available from February 2027 to engage with us on proposed governance and operating structures ahead of submitting an application. See Chapter 9 for more information on authorisation.

Outsourcing and oversight
4.7 Several respondents questioned the need for bespoke outsourcing provisions. They
asserted that existing FCA frameworks already address outsourcing risks and additional requirements could lead to inconsistency across sectors. A small number requested clarification on whether SYSC 8.1.1R (outsourcing requirements) prevented outsourcing to third‑party service providers outside a firm’s group. Several respondents sought clarification on application to arrangements involving third parties and group entities, particularly where firms rely on external inputs as part of the ESG ratings process. Some asked about the distinction between outsourcing arrangements and the use of external data inputs. Our response We are proceeding as consulted on. We recognise the importance of consistency with the existing FCA framework. Our requirements build on the existing SYSC outsourcing framework and should be applied alongside it. Given the significant reliance on outsourced arrangements within ESG rating business models, we have retained our position to apply SYSC 8.1.1 as a rule rather than guidance. Our approach is designed to accommodate these arrangements while ensuring that authorised firms remain responsible for the ESG ratings they provide. We confirm that SYSC 8.1.1R does not prevent providers from outsourcing functions to entities outside their group, although our tailored rules in ESG 6.2 set out which aspects cannot be outsourced. Providers may continue to use third‑party service providers, subject to compliance with the applicable outsourcing requirements. We also recognise that providers may rely on a range of external arrangements. This includes shared service providers, external datasets, third‑party methodologies and technology providers. Providers remain responsible for making sure these arrangements are appropriately governed and that any risks to the integrity, quality or independence of ESG ratings are appropriately managed. These arrangements should be managed in a manner appropriate to the nature and scale of the risks involved. Proportionality
4.8 Most respondents emphasised proportionate application of governance requirements,
particularly for smaller, specialist or early‑stage providers. Several feared requirements could increase costs, deter entry and reduce diversity in the market. Several respondents asked how proportionality would be applied in practice.

Our response
We are proceeding as consulted on.
Proportionality is embedded within the governance requirements. Our requirements are principles‑based and are designed to operate across different business models. We expect providers’ arrangements to reflect the scale, nature and complexity of their activities. We do not expect smaller, specialist, or early‑stage providers to have the same arrangements as larger firms. We will assess providers on a firm‑by‑firm basis at authorisation. This approach supports innovation and new market entry while making sure all providers meet minimum standards appropriate to their business for governance, oversight and responsibility. Systems and controls: feedback received and our response Quality control and methodology
4.9 Most respondents agreed with our proposals on quality control processes and how
methodologies should be managed.
4.10 There was broad agreement that methodologies should be clearly defined, applied
consistently and reviewed periodically. A few respondents misinterpreted this language to mean that methodologies must be the same across providers. Other feedback questioned whether this requirement would be workable for models that rely on AI or where the methodology changes over time as underlying algorithms are updated or retrained.
4.11 Several respondents suggested our rules should specify the minimum frequency for
methodology and ESG rating product reviews, such as yearly reviews. Others preferred a principles‑based approach. Our response We are proceeding as consulted on. We consider our approach on the frequency of reviews appropriately flexible. It accommodates different rating products and allows firms to determine the appropriate frequency. Our transparency and stakeholder engagement requirements will also help users to understand when reviews of ESG rating products have taken place and provide feedback to providers where desired.

The requirement for methodologies to be applied systematically and consistently does not mean that all providers must use the same methodology. Rather, ESG ratings issued from the same product line (ie using the same methodology) must be produced under a consistent approach. We do not believe this rule poses significant challenges for AI‑driven or algorithmic models. For example, it would not prevent a methodology from frequently being updated. ESG ratings issued within a product line must be produced in line with the relevant methodology. Data quality and accuracy
4.12 We received broad support for this proposal, with many responses highlighting that data
quality and accuracy are central to credibility and market trust.
4.13 However, some respondents sought clarification on how the terms ‘accurate’ and
‘up‑to‑date’ would be interpreted in practice.
Data accuracy
4.14 A small number of respondents stated that interpretations of accuracy may differ
between stakeholders. This is particularly the case where a singular objective ‘truth’ is not clear, given ESG ratings are subjective. For example, certain categories of data inputted into an ESG rating could be measured in different ways without clear consensus on which method is optimal.
4.15 A small number of other respondents also highlighted that providers often use data
directly supplied by a rated entity on the assumption that it is accurate without verifying its accuracy. Our response We are proceeding as consulted on. Our rule requires ESG rating providers to implement and maintain policies, procedures, and systems to ensure they use accurate information when producing ratings. In practice, providers should take reasonable steps to make sure the data they use is accurate. Providers should have robust processes and controls for doing so. We recognise that some data estimates involve uncertainty. For example, a provider may use proxy data where it has implemented, maintained and followed a robust approach to data accuracy. This could include having documented policies setting out when proxy data may be used.

Requirement for information to be up to date
4.16 Respondents asked how the requirement to use up‑to‑date information would
operate in practice, particularly across different types of products. Some respondents questioned how frequently a rating would need to be updated when underlying data changes. Others were concerned that frequent updates could be unduly burdensome for certain products, such as point‑in‑time ratings. Our response We are proceeding as consulted on. Our rule requires providers to implement and maintain policies, procedures and systems to ensure that they rely on up‑to‑date information when producing an ESG rating. In practice, this means providers must use the most timely information available to them at the time they produce or update a rating. This rule is not intended to require providers to update ratings with real‑time data on a continuous basis. The application of this rule may also vary across types of ESG rating products. For example, a point‑in‑time rating that is clearly described as such is unlikely to require updating to ensure continuing timeliness of the information used. By contrast, a live ESG rating may require information to be refreshed as part of a rating update or in periodic review. Record keeping
4.17 We received broad support for our record keeping proposals, with mixed feedback on a
few specific elements.
4.18 Some providers disagreed with the requirement to keep the data used to produce an
ESG rating, such that it could be reproduced. Concerns were centred around the volume of data that could be captured by this rule, including data not directly relevant to an ESG rating, and the operational and storage burden. Suggestions included amending our rule to focus on retaining data that supports understanding of an ESG rating.
4.19 Some respondents asked how long records should be retained, with some suggesting
we specify a minimum time period, with 5 years the most commonly requested. Our response We have amended our rules for what information needs to be kept as records. We recognise concerns that the original proposal could create unintended operational and storage burdens for providers. With our updated approach, providers must retain records to enable them to explain and evidence how an ESG rating was produced and how the final ESG rating outcome was determined.

This change addresses the concerns raised while supporting effective regulatory oversight. We are not introducing a specific retention period. Instead, providers should follow guidance set out in SYSC 9 that records should be kept for as long as is relevant for the purposes for which they were made. Providers should also have regard to other requirements under the regime when determining appropriate retention periods, for example the requirement to deal with complaints raised within 3 years of the matter giving rise to the complaint (see Chapter 6). Notifications of changes to methodology
4.20 Most respondents supported notifying users of material changes to a methodology.
There was less broad support for extending this notification to rated entities.
4.21 Some respondents sought refinement or clarification of the policy including
the rationale for extending advance notifications to rated entities, and how the principles‑based approach to materiality and the timing of notifications would be applied in practice. We detail these areas of feedback below, along with our response. Requirement to notify users and rated entities of a material change to methodology
4.22 Several respondents felt the operational burden of notification to rated entities would
be excessive. They cited the effort required to identify, contact and maintain the contact details of the relevant stakeholders. Some respondents queried whether advance notification was needed for any stakeholder group and instead suggested using change‑logs to communicate methodology updates after they have taken place. Our response We have amended our rules on advance notification of material methodology changes. Providers must give users advance notice of material changes to methodologies, but they will not be required to provide advance notice to rated entities. To best manage and mitigate the impacts of a material methodology change, users need to be aware of the details of the change and have time to act accordingly. We do not agree that the change‑logs would achieve this. We have considered whether rated entities should also receive advance notice. Considering feedback regarding the burden relative to the risk of harm, we do not consider it proportionate to require this.

Rated entities will still be able to access publicly disclosed information about the most recent material methodology change. This includes when it took effect, the nature of the change and its general impact on the ESG ratings. They will also be able to request additional information about the relevant methodology and its review process. Timing and materiality
4.23 Several respondents wanted clarity on how providers should determine whether a
methodology change is ‘material’ and what would constitute ‘sufficient time’ for users to consider the change. They outlined that these concepts could be interpreted differently across providers. Our response We have introduced guidance setting out examples of factors that firms may consider when assessing whether a methodology change is ‘material’. This includes the likely impact of the change on the ratings outcomes, whether the firm is aware ratings have been integrated into users’ products or services, and whether fundamental characteristics of the methodology have changed. We have maintained a principles‑based approach, allowing providers to consider the nature and significance of a given change and its circumstances. What constitutes a material change may vary between different types of methodologies, products and user bases. Providers are best placed to assess the materiality of methodology changes and determine how much notice users require. Providers will also be required to publicly disclose the factors they use to determine whether a methodology change is material. Notification to the public
4.24 Some called for advance notice of material methodology changes to be made publicly
available, rather than provided only to users and rated entities. Our response We are proceeding as consulted on. Under this approach, advance notice of a material methodology change would not generally need to be made publicly available where the relevant ESG rating is not publicly accessible. However, where an ESG rating is freely accessible to the public, advance notice must be provided. In these cases, providers may do so through public notice, such as on their website, rather than through proactive notification.

Chapter 5
Conflicts of interest
5.1 We consulted on principles‑based requirements for ESG rating providers to:

Have policies and procedures to identify, prevent and manage conflicts of interest.
Disclose certain information related to the conflict. This applies where providers
cannot be reasonably confident that risks to the integrity or independence of an ESG rating will be prevented.
Keep records of conflicts of interest and ensure their senior management is
updated yearly.
Maintain effective systems and controls to take all reasonable steps to prevent or
manage conflicts of interest.
Have policies and systems to prevent certain personal transactions.
5.2 We wanted to limit the impact of conflicts of interest on ESG rating processes and
outcomes. We also wanted to enable users to access transparent disclosures on conflicts of interest. This would help them understand the nature and potential impact of these conflicts. Summary of final approach for conflicts of interest
5.3 We are maintaining the approach consulted on for the conflicts of interest rules, while
updating the approach to personal transactions. Providers need to have a policy in place that sets out how they prevent certain types of personal transactions, instead of applying COBS 11.7 in the Conduct of Business Sourcebook.
5.4 We have provided further clarification and examples in this chapter.
Feedback received and our response
5.5 Most respondents supported our proposals and welcomed our alignment with the
IOSCO recommendations and the ICMA Code of Conduct. However, some raised concerns about the threshold for disclosing conflicts and sought greater clarity on conflicts management across different business models. A few respondents also suggested requiring conflict of interest disclosures to be made alongside the transparency disclosures.

Management of conflicts in different business models
5.6 Some respondents asked how to identify and manage conflicts of interest arising from
different business models. This included larger group structures and the provision of ancillary services, particularly consultancy services. They asked whether certain conflicts, such as those arising from issuer‑pays models, should always require disclosures and how we expect firms to use information barriers. Our response We have set out examples of poor and good practice at the end of this
chapter to help firms understand how our expectations could apply in
practice and to help support implementation. The good practice examples do not set out the only way we expect conflicts to be handled, in the same or in different situations. Firms are expected to assess the risk of conflicts in their business models and decide on the appropriate procedures to identify, prevent, manage and where necessary, disclose conflicts. Where a firm has taken steps to prevent or manage a conflict of interest but cannot be reasonably confident that material risks of damage to the integrity or independence of an ESG rating has been prevented, we would expect the firm to make a public disclosure describing the conflict and the steps taken to manage it. Disclosure threshold – disclosure as a last resort
5.7 A few respondents stated that the threshold of ‘reasonable confidence’ for conflict
disclosure could lead to inconsistencies. They called for us to set a more objective standard for when firms must make disclosures. Our response We are proceeding as consulted on. We do not consider a prescriptive disclosure requirement appropriate, given the range of conflicts that may arise across different business models. A principles‑based approach allows firms to determine whether the measures they have implemented to prevent and manage conflicts are sufficient. We expect firms to focus on preventing conflicts. We have updated this rule to make clear that disclosure should be a last resort where conflicts continue to pose a material risk of damaging the integrity and independence of a rating. We will assess the adequacy of firms’ conflicts management arrangements through supervision. Retaining the ‘reasonable confidence’ disclosure threshold is consistent with the wider FCA approach to managing conflicts of interest in SYSC 10. We have also provided examples at the end of this chapter to support firms’ understanding of our expectations.

Location of disclosures
5.8 Some respondents suggested requiring providers to include conflicts of interest
disclosures within their minimum disclosures under our transparency rules. Respondents suggested this would support firms’ understanding and application of our rules and help users to find disclosures easily. Our response We do not require providers to make all the minimum disclosures in a single location or document. We also do not specify where conflict of interest disclosures must be made. For example, a firm could make its conflicts disclosures under each relevant rating product or alongside other minimum disclosures. However, providers must comply with our requirement for disclosures, including conflicts of interest disclosures, to be easily accessible, prominent, free to obtain, clearly presented and easy to understand. Conflicts of interest examples
5.9 The examples below are illustrative and non‑exhaustive. They show how providers might
identify, prevent, manage or disclose conflicts in different circumstances. The examples do not create additional requirements or expectations beyond those set out in our rules and guidance, nor should they be treated as a prescriptive checklist. Providers remain responsible for assessing the risk of conflicts arising from their business models and for determining and implementing appropriate arrangements to identify, prevent, manage and, where necessary, disclose conflicts of interest. Example 1: A firm provides both ESG ratings and consulting services Good practice The firm has implemented a framework to manage conflicts between ESG rating and consulting activities. The framework recognises the potential incentive to assign more favourable ratings to retain or attract consulting business. Employees receive training and understand their responsibilities under the firm’s conflicts of interest framework. The firm has assigned responsibility for each activity to separate teams to avoid conflicts arising from overlapping roles. The firm maintains information barriers, including restrictions to file‑sharing, between business lines to prevent the inappropriate use or disclosure of material non‑public information.

Poor practice
The firm has a formal conflicts of interest policy which gives wide discretion to employees when it comes to identifying and managing conflicts between ESG ratings and consulting activities. Employees involved in the work decide whether formal separation of responsibilities, or controls over the sharing of information between business lines, is necessary. There is no requirement to escalate to more senior members of staff. Example 2: An ESG rating provider is a subsidiary of a larger parent company Good practice The ESG rating provider has assessed how group relationships, activities and governance arrangements could give rise to actual or perceived conflicts of interest. The provider has established controls to protect the independence of its ESG rating activities. They maintain a conflicts of interest policy that addresses risks specific to the ESG rating business model. The firm has also identified and resolved any inconsistencies between the ESG rating provider’s conflicts framework and wider group policies. The provider maintains information barriers with business lines that have potentially conflicting interests. This includes through team separation, need‑to‑know access controls, and physical, technological and communication safeguards to prevent the inappropriate sharing of information. Poor practice The ESG rating provider relies on the wider group’s general conflicts framework and does not adequately assess whether relationships, activities or reporting lines elsewhere in the group create specific conflicts for the ESG ratings business. There is limited oversight of how information is shared across the group, and responsibilities between the ESG rating provider and other group entities are not clearly defined. Example 3: An ESG rating provider has an issuer‑pays business model Good practice The ESG rating provider has identified the conflicts risks associated with its issuer‑pays business model and has implemented measures to safeguard the integrity and independence of its ratings. The firm conducts quality control, data validation and methodology reviews to make sure it produces ratings consistently and in line with the stated methodology and that ratings are not influenced by commercial considerations. The firm also keeps employees involved in producing ESG ratings separate from those responsible for sales, marketing or other commercial activities involving rated entities.

The firm publicly discloses that it operates an issuer‑pays business model. This enables users of ratings to understand the potential conflicts associated with the model and how they are managed. Poor practice The firm has limited oversight of whether ratings are consistent with its published methodology. The same employees are involved in both rating activities and commercial discussions with rated entities. The firm also has not considered whether it has taken sufficient steps to prevent conflicts arising and does not disclose that it operates an issuer‑pays model. Personal transactions
5.10 Our proposals on personal transactions were intended to reduce the risk of conflicts of
interest and insider trading.
5.11 Just over half of those who responded to the question on personal transactions
supported the policy intention of our proposals. However, some respondents raised concerns about the proportionality and implementation of the rules.
5.12 Having considered this feedback, we have revised our approach.
Proportionality of approach and clarification of expectations
5.13 Some stakeholders stated that the ESG rating sector presents a lower risk for insider
dealing and market abuse activity compared to sectors already subject to the COBS personal account dealing rules. This is because ESG ratings are generally less reliant on transaction‑sensitive information. These respondents argued that our proposals could impose a disproportionate burden on firms, including if firms would be expected to monitor employees’ personal transactions. Respondents also said that risks may vary across different ESG rating business models. Stronger controls would be needed where ESG ratings involve significant analyst discretion or access to material non‑public information, compared to where ratings are based primarily on public information.
5.14 Some queried whether the proposals would require active monitoring of employee
trading. They sought clarity on the scope of the requirements, particularly how providers should identify employees who are ‘directly involved in the rating process’. Our response We have updated our approach to give providers more flexibility to implement personal transactions controls that are proportionate to the nature, scale and complexity of their business.

ESG rating providers will not be required to comply with the personal transaction rules set out in COBS 11.7 on personal account dealing. Instead, they must have arrangements to prevent certain types of personal transactions and a policy that sets out these restrictions and who they apply to. These requirements are designed to address conflicts of interest arising from personal transactions. For example, they are designed to mitigate the risk that an employee who can materially influence an ESG rating could benefit from a personal transaction linked to that rating. We are not requiring providers to actively monitor employee trading. However, we expect firms to assess whether monitoring would be an appropriate control given the risks in their business. Our approach gives providers flexibility to implement controls that reflect the risks associated with their activities.

Chapter 6
Stakeholder engagement and complaints
6.1 We proposed a framework for stakeholder engagement and complaints processes.
Our aim was to improve the quality of underlying information and understanding of ESG ratings through stakeholder engagement and ensuring that complaints are handled fairly and consistently.
6.2 We proposed that providers must:

Notify rated entities ahead of an ESG rating being made available for the first time.
Ensure that rated entities can request the data behind the rating and offer factual
corrections.
Have formal channels for feedback and complaints.
Have clear and effective policies and procedures for handling complaints.
Investigate, record, and address complaints appropriately, and use complaints data
to identify and resolve recurring or systemic issues.
6.3 We also consulted jointly with the Financial Ombudsman Service (Financial
Ombudsman), proposing that complaints about providing an ESG rating should not fall within its compulsory or voluntary jurisdiction. We also proposed that the Financial Services Compensation Scheme (FSCS) cover should not apply to ESG rating activities. Summary of final approach for stakeholder engagement, complaints and dispute resolution
6.4 We have retained the approach we consulted on for complaints, the Financial
Ombudsman and FSCS. We have refined some elements of stakeholder engagement. In particular, we have:
Updated the timelines for ESG rating providers to notify rated entities, to provide
more clarity.
Removed the requirement for providers to wait for feedback from rated entities
before publishing a rating.
6.5 We have also clarified how our stakeholder engagement rules apply to different
product types.

Stakeholder engagement
Feedback received and our response
6.6 While we received overall support for the stakeholder engagement proposals, this was
one of the policy areas with the most extensive and mixed feedback. Many highlighted the importance of robust stakeholder engagement and agreed that it can support the quality of ESG ratings. However, concerns were raised about the burden of the proposals, differences from the EU regime, and application of these rules to different product types. Notification to rated entities
6.7 Most respondents agreed we should require providers to notify rated entities when
they will be the subject of a new ESG rating. Support was especially strong among rated entities and users. Many providers also agreed, with several, including smaller firms, saying they already do this. However, several providers were concerned about:

The time and resource needed to issue notifications.
Challenges in identifying points of contact.
ESG ratings being held up while they waited to hear from rated entities.
Timing of the notification
6.8 We proposed that providers should notify rated entities when they decide to produce a
new rating. Some feedback highlighted different possible interpretations, which could lead to inconsistent outcomes. A number of respondents asked us to clarify what ‘sufficient’ time means in the context of notifying a rated entity. Some said we should follow the EU approach, where providers must notify entities at least 2 working days before publishing an ESG rating. Some respondents feared divergence could add friction for providers operating across both regimes. Our response We have updated the policy approach. Providers must notify rated entities sufficiently in advance of an ESG rating being made available for the first time. The notification period must be long enough to allow rated entities to read and understand the information provided, with a minimum notice period of 2 business days. We do not expect 2 business days to be enough in all cases. This change meets our aim, while removing potential operational frictions for firms operating across the UK and the EU. We have considered the feedback about inconsistent approaches to the timing of notification. However, we believe that different advance notification periods will be appropriate for different products depending

on the complexity of the product, the amount of data involved, and any existing relationship with the rated entity. Identifying and notifying notifiable persons
6.9 Some respondents, notably providers, were concerned about difficulties in locating the
relevant notifiable persons, including where the subject of the rating is not a company. Others suggested that the resource required to find and notify these stakeholders would be disproportionate, especially for smaller providers.
6.10 Several providers, including smaller firms, said they already meet this element of the
regime under their current practices.
Our response
We are proceeding as consulted on.
The definition of a ‘notifiable person’ is limited to those who are ‘reasonably identifiable’. If a provider has made reasonable attempts to identify a notifiable person but cannot do so, then the provider will not be expected to make the notification. We consider the notification to rated entities to be a key component of the regime, to improve trust and transparency in the ESG ratings market. Notification for updates to an ESG rating
6.11 Some respondents called for the notification rules to be extended beyond when a firm
produces a new rating, to when a rating is updated.
Our response
We are proceeding as consulted on.
We understand the rationale behind this feedback but think it would be a disproportionate burden on firms. Practical difficulties could include high notification volumes for frequently updated ratings. Across the stakeholder engagement rules we have sought to balance fairness for rated entities and users against burden on providers. Beyond this initial notification, rated entities will have the ongoing right to request the data underlying the rating, offer factual corrections and access formal feedback and complaints channels.

Approach to ratings that have already been issued
6.12 A few respondents asked how the rules would apply to ratings issued before the regime
comes into effect.
Our response
We are proceeding as consulted on.
The notification rules apply when an ESG rating is made available for the first time. They will not apply retroactively to ESG ratings made available before the regime comes into effect. As best practice, providers may wish to notify rated entities of pre‑existing ratings if the entity is not aware of the rating’s existence. However, we do not consider it proportionate to mandate this requirement. All rated entities will have the option to request the data underlying their ESG rating. They will also be able to propose corrections and use feedback and complaint channels. We consider that this gives rated entities sufficient opportunity to engage with providers on pre‑existing ESG ratings that remain available when the regime takes effect. Application to different types of ESG rating product
6.13 Some respondents had concerns about how to apply the notification rule to certain
types of ESG rating product. For controversy scores, some said the notification rules could delay updates to a rated entity’s score, undermining the timeliness of the product. Others asked about fully automated products with very wide coverage.
6.14 Additionally, some respondents asked us to clarify how the notification requirements
apply to issuer‑pays ratings compared to user‑pays models.
Our response
We are proceeding as consulted on.
Our rules are designed to accommodate a range of product types. For controversy products, we would expect rated entities to be notified before coverage begins. After that, our rules would not require notification if a controversy score changes so would not cause delays. Where a provider has wide coverage or produces ESG ratings using AI or other automated methods, we still expect them to comply with our rules. We have clarified that although notification is required, publication of the rating does not need to wait until the rated entity provides feedback on factual errors.

Notification obligations apply irrespective of whether the ESG rating is produced under an issuer‑pays or user‑pays approach. An issuer‑pays approach may involve an existing relationship and information sharing between a provider and a rated entity, but not always. All rated entities must receive the notification information. Where there is closer engagement, a shorter time between notification and the ESG rating being made available for the first time may be appropriate. Data requests and corrections from rated entities
6.15 There was strong support for allowing rated entities to obtain the data underlying their
ESG ratings and offer factual corrections. Respondents agreed that this can support better quality ratings. Some respondents proposed limiting the scope of corrections that may be offered, and several providers also raised concerns about potential delays to publishing ESG ratings. Below, we set out this feedback in more detail and respond. Requesting data
6.16 Some stakeholders suggested that rated entities should be able to request the data
underlying an ESG rating both before and after a rating is published. A few providers asked us to clarify what is meant by underlying data. Our response We are proceeding as consulted on. We confirm that a rated entity may request the data underlying its rating at any time, both before and after that rating has been made available. In this context, underlying data is the data that the provider has used to produce the rating. Requesting additional information
6.17 Some respondents called for rated entities to be able to obtain further information
before an ESG rating is published, including the full ESG rating report and overall rating. Our response We are proceeding as consulted on. The policy intention underpinning the right to request underlying data is to support the factual accuracy of ESG ratings. We do not believe rated entities need to see the final product before it is published. If desired, a rated entity can request disclosures associated with their rating once it has been made available and raise concerns through feedback and complaint channels.

Impacts on publication timelines
6.18 Some respondents said allowing rated entities time to review data before the ESG rating
is made available could lead to uncertainty and delays in issuing ratings. This could affect production schedules and impair the timeliness of a provider’s offering. Our response We have updated the policy approach consulted on. Providers may make a rating available while a rated entity reviews the underlying data. Our intent was to make sure rated entities could offer factual corrections. Some corrections may need to be made by providers after a rating has been made available. We believe this approach is proportionate, balancing the needs of providers, rated entities and users. Scope of corrections
6.19 Some respondents were concerned that corrections may be based around more
subjective elements of a rating, such as objections to the methodology or types of information used to form the rating. There were suggestions to limit corrections to factual errors only, and not elements such as methodological choices. Our response We are proceeding as consulted on. Under this approach, corrections should already be limited to factual errors. If a rated entity has objections to a provider’s methodology or other elements of the ESG rating, they can raise this through the relevant feedback channels. Complaints handling and dispute resolution Feedback received and our response
6.20 Most respondents supported the introduction of a formal framework for concerns to be
raised and considered through a transparent process. Many respondents also welcomed greater consistency in complaints handling across the market. However, some respondents raised concerns about specific aspects of the proposals, as set out below.

The definition of a complaint and who may submit a complaint
6.21 Respondents, namely providers, were concerned about the proposed definition of a
complaint. Several suggested complaints should be limited to factual inaccuracies, data errors and process failures. They were concerned the framework could be a mechanism for challenging rating opinions.
6.22 Some providers argued that complaints should be limited to users and rated entities,
to reduce the risk of strategic or commercially motivated complaints.
6.23 Some users and rated entities called for the framework to build in an escalation
route to the FCA.
Our response
We are proceeding as consulted on.
The complaints framework should not be used to challenge rating opinions or undermine analytical independence. However, we do not consider it appropriate to limit complaints to factual inaccuracies, or to only allow users and rated entities to raise complaints. Complaints may legitimately arise from a range of stakeholders and relate to various aspects of the ESG rating process. The complaint rules are intended to ensure that concerns are considered and addressed appropriately. The framework is not intended to create a right of appeal against methodologies, assumptions or analytical judgements. Firms remain responsible for determining whether a complaint is valid and requires investigation, in line with our complaints rules. Through our supervisory approach, we will monitor providers’ compliance with the complaints‑handling requirements. Three‑year complaints window
6.24 Feedback on the proposed 3‑year complaints period was mixed. Users in particular
found it reasonable. Some providers and trade bodies considered 3 years disproportionate given the frequency of ratings and underlying data changes. Several suggested a shorter period, while others favoured a principles‑based approach similar to the EU framework. Our response We are proceeding as consulted on. We recognise concerns that ESG ratings, methodologies and underlying information may change over time. However, we consider that 3 years provides complainants with a reasonable opportunity to raise concerns, particularly where issues may not be immediately apparent. We do not consider that a principles‑based approach would provide sufficient certainty.

Proportionality
6.25 Many respondents highlighted proportionality, particularly for smaller providers.
Concerns included increased implementation costs, resourcing, record keeping, complaint monitoring and ongoing administration. Several also asked how the requirements would apply across different business models and operating structures. Our response The requirements are principles‑based and are not intended to prescribe a single approach to implementation. Firms may design and operate their complaints framework in a manner that is appropriate to their business model and operating structure, provided they meet the requirements in our rules. This approach is intended to allow firms flexibility in how they comply, while ensuring that complainants receive fair outcomes. Financial Ombudsman Service and FSCS Feedback received and our response
6.26 Most respondents agreed with our proposals not to extend either the compulsory or
voluntary jurisdiction of the Financial Ombudsman, and not to provide FSCS cover for ESG rating activities.
6.27 Respondents stated that ESG ratings are predominantly wholesale products provided
to institutional users and that providers do not hold client money. Several felt bespoke complaints requirements and FCA supervision would provide a more appropriate framework than consumer redress schemes designed for retail financial services.
6.28 A small number of respondents disagreed. They asserted that consumers may directly
rely on ratings in the future and suggested the position should be kept under review. A small number also sought greater clarity on liability and redress where losses arise following reliance on ratings. Our response We are proceeding as consulted on. ESG rating providers do not typically undertake the activities for which Financial Ombudsman jurisdiction and FSCS protection were designed. We consider the complaints framework we have introduced appropriate for the types of complaints that arise in the ESG ratings sector. Our approach does not affect any rights or remedies that may otherwise be available under law. We will continue to monitor how ratings are used and relied on by market participants, including consumers, and whether further action may be necessary.

Chapter 7
Senior Managers and Certification Regime
7.1 We proposed applying the existing SM&CR framework to ESG rating providers, to
promote effective governance, accountability and individual responsibility across ESG rating activities.
7.2 We proposed that ESG rating providers should be categorised as Core firms, the default
categorisation under the regime. Our proposals included:

The Senior Managers Regime, including our approval of relevant Senior Management
Functions (SMFs), but excluding SMF17 (Money Laundering Reporting).
Requirement for providers to assess and submit to us fit and proper assessments
for Senior Managers, regulatory references and criminal record checks, where required.
Clear allocation of responsibilities under the SM&CR framework, using the
Statement of Responsibilities (SoR).
The Certification Regime, although we did not expect many, if any, employees of
ESG rating providers to perform Certification Functions.
The Conduct Rules (COCON).
7.3 We also acknowledged the ongoing review of SM&CR and explained that we would
incorporate any resulting reforms into our final policy position, dependent on timelines. Summary of final approach for SM&CR
7.4 We are proceeding as consulted on. ESG rating providers will be subject to the SM&CR as
Core firms, including the Senior Managers Regime, the Conduct Rules, the Certification Regime (where applicable) and fitness and propriety requirements.
7.5 We have considered the proposals consulted on in the FCA's SM&CR Review: Phase 2
CP26/37 and the Prudential Regulatory Authority's CP14/26. Based on the current scope of these consultations, we do not expect resulting reforms to materially affect the Core firm requirements that will apply to ESG rating providers. We do not consider it appropriate to delay the application of the SM&CR requirements. We will publish further information for providers applying for authorisation as the SM&CR reforms progress. Feedback received and our response
7.6 Most respondents supported categorising ESG rating providers as Core firms.
They agreed that providers should be subject to requirements comparable to other FCA‑regulated firms.

7.7 Several respondents noted the ongoing review of SM&CR. They raised concerns about
duplication and unnecessary implementation costs if requirements changed. Several suggested delaying implementation until the wider review concludes.
7.8 A few ESG rating providers questioned whether the Core categorisation was
proportionate to the nature and risk profile of ESG rating providers. They suggested categorising providers as Limited Scope firms or introducing a bespoke regime.
7.9 A small number of respondents suggested introducing additional SM&CR requirements
specific to ESG rating providers. This included a prescribed responsibility (PR) for oversight of methodologies and data sources, as well as introducing a certification function for individuals performing key methodology, data and analytical roles. They sought clearer accountability for methodology governance, data quality and model oversight. Our response We are proceeding as consulted on. We recognise concerns about the ongoing review of the SM&CR. However, for the reasons set out in 7.5, we do not consider it appropriate to delay implementation. The most appropriate approach is to categorise ESG rating providers as Core firms, aligning them with the framework that applies to most FCA‑authorised firms. The allocation of senior management responsibilities under the Core regime is appropriate for supporting accountability. We do not consider Limited Scope firm status appropriate for providers. This category generally applies to firms whose regulated activities are ancillary to their principal business, as well as certain sole traders and other firms with relatively simple management structures. The narrower allocation of responsibilities under the Limited Scope regime would not provide the appropriate level of accountability. We are not introducing a bespoke PR or Certification Function for ESG rating providers. We believe the existing SM&CR framework, together with our governance, systems and controls requirements, provides an appropriate basis for accountability. We also continue to expect relatively few employees of ESG rating providers, if any, to perform existing Certification Functions as very few of these functions would apply in these firms. Providers should be ready to comply with the relevant SM&CR requirements from the go‑live date. We expect providers to familiarise themselves with these requirements in advance to support timely and effective implementation. As set out above, we will publish further information for providers applying for authorisation as the SM&CR reforms progress.

Chapter 8
Perimeter guidance
8.1 We consulted on new perimeter guidance (PERG in the FCA Handbook) to help firms
understand the scope of the regulated activity. PERG represents the FCA’s view of the legislation and is not legally binding. Feedback received and our response
8.2 Stakeholders supported the guidance and generally found it clear and helpful.
8.3 Many asked for more guidance and examples. In particular, criteria for when a provider
could ‘reasonably expect’ a rating is ‘likely to influence’ an investment decision including what information we would consider. They sought clarity on whether specific products and use cases, including supply chain tools, would be in scope. A few were concerned that firms might be expected to monitor downstream use of products not intended for investment purposes.
8.4 Some stakeholders raised questions about the definition of a rating and the distinction
between a data product and a rating product. Examples included portfolio‑level analytical tools, numeric outputs and customisable methodologies.
8.5 Stakeholders sought clarity on certain exclusions outlined in the legislation. This
included ratings produced in the course of another regulated activity, ratings produced by charities and academic institutions, and ratings produced for private use. Several also asked for further clarity on what constitutes a ‘standalone’ rating. Our response We have revised PERG to include additional clarification and examples on our understanding of the ‘likely to influence’ and ‘reasonably expect’ criteria, the distinction between certain ESG data and ratings products which are in scope, and the application of some exclusions, including those for private use and for regulated products and services (as it applies to asset managers). We have added examples of factors a provider may consider when assessing whether a product falls within scope. We have also included examples of how commonly cited ESG data product types may be in or out of scope depending on their features. Respondents raised questions on a range of specific scenarios. However, the guidance is not intended to be exhaustive or deal with every set of circumstances. Firms seeking clarity on their particular circumstances will be able to discuss these during the pre‑application process, and we will consider such matters on a case‑by‑case basis.

Currently regulated products and services involving ESG ratings
8.6 The Treasury’s legislation to bring ESG ratings into our regulatory perimeter excludes
ratings produced in the course of carrying on another regulated activity, except where they are provided as a standalone product or service. In our CP, we said we would assess whether existing standards in our Handbook adequately address potential harms arising from the provision of ESG ratings as part of other regulated activities and consult on any changes if needed.
8.7 We asked whether existing regulatory regimes sufficiently address the risk of harm and,
if not, which areas should be addressed and why.
Feedback received and our response
8.8 Views differed on whether existing Handbook requirements would deliver outcomes
equivalent to those proposed for ESG rating providers.
8.9 Many respondents, including trade bodies, ESG rating providers, users and non‑profit
organisations, considered existing standards for activities such as asset management, benchmark administration and investment research to be sufficient. They argued that firms already subject to FCA regulation pose a lower risk of harm compared to unregulated ESG rating providers. A few felt our approach to only apply existing standards would benefit innovation and competition and support our aim to avoid duplicative regulations.
8.10 Other respondents argued that existing regimes do not fully address ESG rating specific
risks. In particular, they mentioned benchmark administrators’ index assessments and asset managers’ proprietary ratings. They said these activities may have a material influence on investment decisions and should therefore be subject to standards similar to those covered by the ESG ratings regime. Our response We will continue to assess whether further action is needed in the following regulated markets. Asset managers We are interested in firms’ practices when producing proprietary ESG ratings for use in fund marketing materials. We will undertake a targeted desk‑based review and consider next steps. Benchmark administrators As the Treasury’s Benchmark Regime reform is ongoing, we do not consider further action necessary at this stage. As the reform progresses, we will assess whether any further action is needed.

Investment research
We received very limited feedback on this activity. Having considered the market context and examples of firms’ approaches to ESG ratings, we intend to monitor for any emerging harms relating to the use of ESG ratings in this market. In that scenario, we will consider what action is appropriate to address the harms. Investment consultants Investment consultants may produce and provide ESG ratings to clients and potential investors. We are continuing to engage with relevant designated professional bodies (DPBs) to consider whether changes to our Handbook or DPB rules are needed to achieve equivalent outcomes. If we decide to make any changes to our Handbook, we will update publicly on this at a later date.

Chapter 9
Authorisation
9.1 Our aim is to establish a clear and proportionate authorisation gateway. We want to
ensure firms operating in the UK ESG ratings market meet minimum standards, while supporting competition, innovation and international interoperability.
9.2 We did not ask specific questions about authorisation in our CP, other than in relation to
perimeter guidance and application fees. However, respondents commented on several authorisation-related matters as part of their broader feedback on our proposals.
9.3 Firms providing ESG ratings that fall within the scope of the regime will require FCA
authorisation. Applicants will need to show that they meet the Threshold Conditions (TCs) (please see COND in the FCA Handbook). They must also be ready, willing and organised to comply, on a continuing basis, with the requirements and standards of the regulatory system that apply, or will apply, to them in order to be authorised. As part of this assessment, we will consider (among other things) firms’ business plans, resources, governance arrangements and systems and controls. Feedback received and our response Overseas firms, UK presence and accountability
9.4 Respondents asked how the regime would apply to overseas firms and group structures.
This included the use of branch arrangements, the level of UK presence expected, and the allocation of responsibility where rating activities are undertaken across multiple jurisdictions.
9.5 Several stakeholders called for market access routes, such as equivalence, to
reduce duplication and fragmentation for firms operating globally and support UK competitiveness. Our response Firms providing ESG ratings in the UK should have arrangements that support effective supervision and clear governance arrangements to ensure compliance with our regime. Further detail on governance expectations is in Chapter 4. Firms can continue to operate through a range of global structures and business models. However, they should be able to demonstrate appropriate oversight of UK ESG ratings activities and clearly identify where responsibility for those activities sits.

Firms’ governance and organisational arrangements should support effective regulatory oversight. Consistent with our broader Approach to international firms, the appropriateness of any particular operating structure, including the use of a UK branch, will be assessed in light of the specific circumstances of the firm. This includes any relevant jurisdictional considerations, and our ability to supervise it effectively. We will assess each firm’s arrangements on their individual merits. However, many overseas firms are likely to find that a UK‑incorporated subsidiary provides the clearest means of demonstrating accountability and facilitating effective supervision. This is particularly the case where jurisdictional considerations, including differences in regulatory regimes, limit the suitability of a branch structure. Decisions on market access routes are a matter for government. All firms will need to be authorised to continue providing ESG ratings in the UK from when the regime goes live. Proportionality and transition
9.6 Some respondents asked for clarity on the authorisation application assessment,
including the timing of applications and how to prepare for the regime. Some also emphasised the importance of proportionality in the authorisation assessment for smaller or overseas firms. Our response To support readiness, we will provide access to our pre‑application support service (PASS). PASS is a free service that offers firms the opportunity to engage with us before applying for authorisation to discuss their plans, the authorisation journey and our regulatory expectations. We also intend to make application materials available before the authorisation gateway opens. We will engage with firms to help them understand the regime, assess whether they are in scope and prepare applications. The gateway will open one year before the regime comes into force, providing time for firms to submit their applications and for us to assess and determine them ahead of commencement. Our approach to authorisation will take into account the size, scale and complexity of a firm’s business model and the risks it presents. However, all firms must satisfy the minimum standards and meet the TCs to be authorised.

The authorisation assessment
9.7 The authorisation gateway will open on 24 June 2027, with the regime coming into
force on 29 June 2028. We encourage firms to engage early and submit applications as soon as reasonably practicable according to timelines explained below in 9.9 once the gateway opens.
9.8 In assessing applications, we will consider, among other things, whether firms have
appropriate resources, governance arrangements, systems and controls, and arrangements for managing conflicts of interest and overseeing ESG ratings activities.
9.9 During the gateway period, larger firms must apply within the first month of the gateway
opening, i.e. before the end of July 2027. We consider ‘larger firms’ to be those that, at the point of application, reasonably expect to generate £500,000 or more in annual revenue from ESG ratings activities in the UK during the 12‑month period following submission of their application. Other firms must apply within the second month, i.e. by the end of August 2027.
9.10 According to the Financial Services and Markets Act 2000 (Regulated Activities)
(ESG Ratings) Order 2025, firms that do not apply within the stated timeframe, withdraw their applications, or whose applications are refused, will not be able to take on new business once the regime goes live and will need to wind their business down.
9.11 Under the legislation, firms that apply within the stated timeframe, but where we have
not determined their application by 29 June 2028, will be able to continue business as normal, until we determine their application. This can include taking on new business. Fees
9.12 We consulted on the fee‑block structure and pricing categories for ESG rating providers
applying for authorisation. We proposed a 2‑tier application fee. This reflected the higher cost of assessing larger ESG rating providers at the gateway, due to their more complex business models and greater volume of current activity. We proposed that existing firms with forecast annual relevant revenue of less than £250,000 during the gateway period would pay a Category 4 application fee (currently £2,820). Existing firms with forecast annual relevant revenue of £250,000 or more would pay the Category 6 application fee (currently £11,260).
9.13 We also proposed a Category 4 fee for all applications submitted after the gateway
closes, as higher processing costs are expected only during the gateway.
9.14 Our consultation also noted that ongoing supervisory costs will be recovered from
ESG rating providers through annual fees. Further information on these fees will be outlined in our regulatory fees and levies consultation paper, which we will publish later in November.

Feedback received and our response
9.15 Many respondents supported the proposal. They agreed the 2‑tier approach was a
proportionate way to recover costs and reflects the larger processing costs associated with larger providers.
9.16 However, several respondents expressed concerns with the thresholds. While some
respondents considered a threshold of £250,000 of forecasted annual revenue reasonable, most considered this too low. Respondents said it would capture most ESG rating providers as ‘large’, subjecting them to the higher application fee and creating barriers to entry. Our response Following broadly positive feedback, we are proceeding with:

The new A.27 fee-block for ESG rating providers.
The 2-tiered application fee structure during the gateway period.
A Category 4 fee for all applications once the gateway closes.
Following further analysis and engagement, including with trade bodies, we are increasing the relevant annual revenue threshold to £500,000. We believe this threshold more accurately reflects the structure of the market and helps ensure application fees remain proportionate, by balancing the need to minimise barriers to entry with the costs of processing applications. Clarifying amendment to our rules
9.17 We have amended certain rules to better align them to our original policy intent and
provide greater certainty for firms.
We have clarified that all ESG rating providers seeking authorisation after the
gateway period will be subject to the Category 4 application fee.
To ensure that our rules apply consistently throughout the gateway, rather than
requiring firms to generate a forecast of revenue before the gateway opens, firms should instead forecast revenue from providing ESG ratings during the 12‑month period following submission of their application.

9.18 The table below sets out our final requirements.
Table 1: ESG rating provider application fee rates
During the gateway period
Applications by firms with a forecast revenue for providing ESG ratings of less than £500,000 for the 12‑month period following the day of submission of their ESG ratings application. Category 4 (currently £2,820) Applications by firms with a forecast revenue for providing ESG ratings of £500,000 or more for the 12‑month period following the day of submission of their ESG ratings application. Category 6 (currently £11,260) After the gateway period All firms Category 4 (currently £2,820)
9.19 To ensure the value of application fees does not erode over time through inflation,
we may increase them annually. Any proposed changes to the above application pricing categories will be included in our annual fees and levies rates consultation, usually published in March.

Chapter 10
After authorisation
10.1 We consulted on applying certain chapters of the Supervision Manual (SUP) to ESG
rating providers. We proposed a phased approach to regulatory reporting to allow testing before finalising our reporting requirements. We also consulted on applying the Enforcement Guide (ENFG) and Decision-Procedure and Penalties manual (DEPP) frameworks. Supervision Feedback received and our response
10.2 Most respondents supported our proposal to apply chapters of SUP. They generally
agreed that using existing supervisory rules and processes would promote consistency with the FCA’s wider supervisory approach and support effective supervisory oversight of ESG rating providers.
10.3 Several respondents highlighted the importance of proportionality in our supervisory
approach, particularly for smaller firms and newer market entrants. They supported the need for supervisory requirements to remain targeted and to avoid duplication or unnecessary complexity.
10.4 A few respondents requested further clarity on how certain supervisory requirements
would apply in practice. This included expectations for providers operating within wider group structures and the supervision of firms with mixed business models.
10.5 Respondents welcomed our proposal not to introduce fixed Handbook regulatory
reporting at the outset of the regime. They supported our proposal to engage with firms to test reporting requirements before introducing Handbook reporting requirements. Our response We are proceeding as consulted on. This is also consistent with the approach we take for other regulated firms. In line with our wider FCA approach to supervision, our supervisory expectations will be risk‑based. We will take account of a provider’s size, structure, business model and the nature of its ESG rating activities when determining our supervisory approach. We recognise that many ESG rating providers will be engaging with financial services regulation for the first time. We will provide more information on our supervisory approach during the pre‑application period to help firms understand our expectations and prepare for authorisation.

We will also continue to develop a proportionate approach to regulatory reporting as part of our wider commitment to becoming a smarter regulator. This year, we carried out a voluntary pilot to inform our regulatory reporting approach once the regime goes live. We tested reporting metrics to help us assess the availability, quality and usefulness of the information to support our supervision approach. We are now refining our approach in light of feedback. From 29 June 2028, regulated ESG ratings providers will need to submit regulatory reporting returns so that we are able to supervise effectively from day one. While these will be non‑Handbook requirements at this stage, we will issue information requests on a mandatory basis. We will seek feedback in this live environment and refine the reporting requirements as appropriate. After a period of testing, we will consult on and finalise the regulatory reporting rules in the FCA Handbook. Testing in a live environment ensures that we can develop effective regulatory reporting rules to support a data‑led approach to supervision. Enforcement
10.6 We consulted on applying ENFG to ESG rating providers, consistent with our approach
to other regulated firms.
Feedback received and our response
10.7 Most respondents supported applying the existing ENFG to ESG rating providers.
They generally agreed that this would promote consistency, support market confidence and provide clarity about our enforcement approach.
10.8 A small number of respondents emphasised the importance of proportionality,
particularly for smaller providers, new entrants and firms operating in a newly regulated market. A few requested additional clarity on the scope of enforcement powers. In particular, they highlighted the need to distinguish between failures to comply with regulatory requirements and legitimate differences in methodologies or analytical judgements to inform ESG rating outputs. Our response We are proceeding as consulted on. We will apply ENFG to ESG rating providers when carrying out enforcement investigations, as we do to other regulated firms. Our focus will be on compliance with the requirements and the overall integrity of the ESG ratings process.

We recognise that many firms will be subject to FCA regulation for the first time. We will work with firms during pre‑application, authorisation and supervision to help them understand the requirements of the regime and what we expect of regulated firms. However, providers remain responsible for complying with the requirements of this regime. Where we identify serious misconduct or significant failings, we may use our enforcement powers in the same way as we do across the wider FCA regulatory regime. How we make decisions and impose penalties
10.9 We consulted on applying DEPP to ESG rating providers.
Feedback received and our response
10.10 Most respondents supported applying the existing DEPP framework. They said using
established decision‑making procedures would promote consistency, transparency and procedural fairness across regulated firms.
10.11 Several respondents emphasised the importance of proportionality in the application of
penalties. This included ensuring they reflect the nature of the breach, firm size and the harm caused by the activity.
10.12 A few respondents sought greater clarity on how penalties would be calculated in
practice, including how ‘relevant revenue’ is assessed, particularly for global group structures. A small number of respondents also raised concerns regarding Senior Manager accountability, particularly for smaller firms.
10.13 There were a few requests for additional guidance, including examples of
behaviours likely to trigger enforcement action, determining how serious a breach is, how the framework will apply in an ESG‑specific context, and cross‑border enforcement considerations. Our response We are proceeding as consulted on. In June 2026, we published a consultation on changes to DEPP (CP26/19). These proposals are intended to improve transparency and consistency. We will apply the DEPP framework to ESG rating providers and stay aligned with any broader updates following the consultation. We recognise the concerns on proportionality and predictability. We confirm that penalties will continue to be determined in line with existing FCA policy, including principles of proportionality and deterrence.

In applying DEPP, we will take into account the size and financial resources of the firm, the nature of the breach and the harm caused. Our enforcement work is intended to ensure real and meaningful consequences for firms and individuals who do not follow our rules and cause actual or potential harm to users of ESG ratings and financial markets.

Chapter 11
Cost benefit analysis (CBA)
11.1 In CP25/34, we provided a cost benefit analysis (CBA) of our proposed approach to
regulation of ESG ratings. This chapter summarises the feedback on the CBA and how we have considered it. We also discuss the updates to our CBA based on the feedback we received and the changes to the final rules.
11.2 Having considered the consultation feedback and the changes to the final rules, the
estimated cost of our final rules has increased by £7.95m over 10 years in present value (PV) terms relative to our CBA estimate. The increase in the estimated cost of the final rules is mostly driven by feedback to the CBA regarding the costs of establishing an appropriate UK presence, which relates to overseas ESG rating providers that do not currently have a UK presence. The estimated cost of the final rules is £99.80m over 10 years in PV terms.
11.3 Our overall conclusion remains unchanged. We expect the final rules to be net beneficial,
generating an estimated net benefit of £569.82m over 10 years in PV terms. Summary of the CBA in CP25/34
11.4 In the CBA for CP25/34, we described the benefits of our proposals and how they would
result in more transparent, reliable and understandable ESG ratings. We expected the proposals to also generate indirect benefits by reducing users’ due diligence costs associated with resolving issues and with obtaining information that is not readily available. We estimated these indirect benefits at £669.62m over 10 years in PV terms.
11.5 We estimated the costs of the proposals to be £91.85m over 10 years in PV terms.
These costs comprised the direct compliance costs incurred by rating providers, some of which we expected providers to pass on to users.
11.6 Overall, our central estimate was that the proposals would generate a net benefit of
£577.78m over 10 years.
Feedback received and our response
11.7 We received 25 responses to our consultation on the CBA.
11.8 Respondents were generally supportive of our CBA, although some challenged certain
aspects of our analysis. The key themes were:

Uncertainty about the extent to which the estimated benefits would materialise.
Potential secondary effects of compliance costs on competition, particularly for
smaller providers and new entrants.
Costs associated with differences between the UK and international regulatory
frameworks, and establishing an appropriate UK presence (for overseas ESG rating providers that do not currently have a UK presence).
Possible underestimation of the costs of certain requirements.
11.9 In most cases, respondents who challenged our estimates did not provide any additional
evidence that would enable us to change our estimates. However, feedback on the costs of establishing an appropriate UK presence highlighted that our assessment included office rental costs but did not separately account for additional governance arrangements and IT support. We have therefore updated our cost estimates to reflect these additional activities (see ‘Our updated cost benefit analysis’). Benefits
11.10 Most respondents who commented on the benefits recognised the expected benefits
of our rules and supported our estimates. A few identified possible additional indirect benefits, such as a fairer assessment of investments in low‑carbon technologies. Our response We recognise that there are additional potential benefits from our proposals beyond those we discussed in the CBA. We sought to identify the most significant benefits, and we used evidence from our surveys of users and providers to quantify them where it was reasonably practicable to do so.
11.11 A few respondents questioned the extent to which the quantified efficiency gains would
materialise, suggesting that we had overestimated the benefits. In particular, they commented that:
users would continue to have regulatory obligations to conduct due diligence
on third‑party data, including ESG ratings, which could limit the incremental efficiency gains;
providers might rely on intellectual property protections to limit disclosures,
reducing the usefulness of the information provided; and
we should monitor whether the estimated efficiency gains materialise.
Our response
In the CBA, the quantified efficiency gains arise from making due diligence more efficient, not from removing the need for users to undertake it. Users may therefore continue to incur some due diligence costs for assessing the suitability and reliability of ESG rating products after the rules take effect.

In our sensitivity analysis, we also considered lower compliance than assumed in our central estimate, including, for example, reduced compliance with disclosure requirements. The proposals remained net beneficial in that scenario. Through our supervisory approach, we will also seek to ensure that firms comply with the policy intention of the disclosure requirements, including where those requirements interact with intellectual property protections. We recognise that the efficiency gains may be difficult to measure systematically. Some users may not experience reduced expenditure if, for example, greater transparency enables them to undertake more extensive due diligence than they would in the counterfactual (see paragraphs 200 to 203 of the CBA). The ‘Measuring success’ annex explains how we intend to monitor the outcomes of the rules. Competition and impacts of costs on smaller providers
11.12 Many respondents raised concerns about the potential impact of compliance costs
on smaller providers and new entrants. They suggested that these costs could have secondary impacts, including reduced innovation, increased market concentration and the pass‑through of compliance costs to users. Our response We considered the potential impacts of our proposals on competition and the burden of compliance costs in the CBA (see paragraphs 156 to 158 and 171). We recognise that some requirements involve fixed costs that may place a greater burden on smaller providers (eg complying with relevant SYSC requirements). However, we do not consider that exempting smaller providers would be appropriate. Some smaller providers told us that an exemption could lead users to regard them as less reliable, which could have adverse impacts on their business. We have sought to ensure that the requirements are inherently proportionate wherever practicable. In several areas, the compliance burden is likely to vary with a provider’s size and business model. For example, under the conflicts of interest requirements, we expect providers to have a conflicts of interest policy which should be appropriate to the nature, scale and complexity of the firm’s business model.

11.13 A few respondents also suggested that we monitor competition in the market.
Our response
As part of our broader supervisory approach, we will monitor market developments and user outcomes to assess whether the market is operating in line with our policy objectives. We will also monitor market participation from smaller providers and competition developments in the market (see ‘Measuring success’ annex). International regulatory alignment and UK presence costs
11.14 Several respondents expressed concern that the CBA did not capture costs arising from
differences among aspects of the proposed UK requirements and EU regulation, the IOSCO recommendations and the ICMA Code of Conduct. Our response Our CBA estimates the full cost of complying with the UK requirements without assuming cost savings for providers that also comply with similar requirements in other jurisdictions, including the EU. As a result, our approach is likely to overstate, rather than understate, the incremental cost of UK compliance for providers that can use common systems and processes to comply across the UK and any overseas regimes. We adopted this assumption because it was not reasonably practicable to estimate the extent of overlap among the UK requirements, other regulatory regimes and providers’ existing practices (see ‘The counterfactual and key assumptions’ in our CBA). This is consistent with our standard CBA approach, as described in paragraphs 7.2 to 7.5 of our Statement of Policy on Cost Benefit Analyses. We also adjusted the survey‑based cost estimates to account for the possibility that providers would need to enhance existing processes or introduce measures beyond the IOSCO recommendations and the Code (see Annex 2.1 to the CBA for more details). Finally, we tested these assumptions in the sensitivity analysis. The proposals remained net beneficial when we accounted for regulatory regimes in other jurisdictions and for increased adoption of the IOSCO recommendations and the Code by the rating providers.

11.15 A few respondents also commented that, in the absence of a third‑country market
access route, global providers might need to establish UK‑specific operational and governance arrangements. Our response Our CBA only included office rental costs for international providers without an existing UK presence, but it did not separately estimate the costs of additional UK‑specific governance arrangements and potential IT support. We have updated the estimates to include these costs, and in the section ‘Costs of establishing a UK presence’, we explain our approach and assumptions. Other costs
11.16 A few stakeholders suggested that the CBA might underestimate the costs incurred
by certain providers. For example, some smaller providers may have more complex business models than the average provider of a similar size and may therefore incur higher compliance costs. Our response In our CBA, we estimated the average compliance cost for each provider size category (large, medium, small), using evidence from a survey of providers. We recognise that actual costs may vary across providers according to factors such as size and business model. Some providers will incur costs above the estimated average and others below it. It is not reasonably practicable to estimate costs for every individual provider. However, because the central estimates are based on data and calibrated assumptions, we consider them to be reasonable estimates of average impacts across the provider population.
11.17 A few respondents also suggested that our CBA underestimated the compliance costs
associated with:

individual rating‑level disclosures (Transparency);
notification requirements (Engagement);
monitoring personal transactions (Conflicts of interest); and
rated entities reviewing and processing information in disclosures (Transparency and
Stakeholder Engagement).

Our response
We have amended the requirements for individual rating‑level disclosures and updated the associated cost estimate. We consider that the CBA estimate for notification requirements reasonably reflected the proposals on which we consulted. However, because the final rules narrow this requirement, we have updated the estimate to reflect the reduced burden. We have also amended the requirements regarding conflicts of interest and personal transactions monitoring. We explain these adjustments in the section ‘Changes to the final rules’. The CBA did not separately estimate costs incurred by rated entities in reviewing and processing information from rating providers. Rated entities are likely to review and process some of this information in the counterfactual. On average, we expect the final rules to make this activity more efficient by improving the information available. However, we do not expect it to materially affect the overall conclusion of the CBA, and it is not reasonably practicable to quantify this impact. Our updated cost benefit analysis Summary and net impacts
11.18 We have updated the CBA in two respects since CP25/34. First, following consultation
feedback, we have added estimated governance and IT‑support costs for international providers that need to establish an appropriate UK presence. Second, we have revised the cost estimates to reflect changes between the consulted proposals and the final rules.
11.19 In Table 2, we summarise the resulting changes to the estimated benefits, costs and
net benefits.
11.20 Having considered the consultation feedback and the changes to the final rules, our
overall conclusion remains unchanged. We expect the final rules to be net beneficial, generating an estimated net benefit of £569.82m over 10 years in PV terms.

11.21 The equivalent annual net direct cost to business (EANDCB) of our final
rules is £11.59m.
Table 2: Updated 10‑year present value of costs and benefits
Category Benefits Costs
Net benefits
(Benefits‑Costs)
CP rules £669.62m £91.85m £577.78m
Change from CP rules £0m £7.95m ‑£7.95m
Final rules £669.62m £99.80m £569.82m
Table notes: Figures might not sum because of rounding.
Costs for establishing appropriate UK presence
11.22 Following consultation feedback, we have updated the estimates for overseas ESG
rating providers that do not currently have a UK presence. The original CBA included office rental costs but did not separately estimate any potential additional governance and IT support resources that these providers might require. As a result, we have updated the estimates to include these additional ongoing costs.
11.23 Respondents did not provide quantitative evidence that we could use to estimate these
costs. We have therefore developed assumptions using our sector knowledge for the potential additional resources that these providers might need.
11.24 Based on the provider survey we estimated that 3 large rating providers, 5 medium and
12 small international providers would need to establish some form of UK presence.
11.25 Providers could meet the requirement of sufficient UK presence either by increasing
their resources, for example, by hiring employees in the UK, or by using existing business‑as‑usual resources, for example, by relocating staff. Because we do not know which approach individual providers will take, we estimate the costs under two scenarios:

High‑cost scenario: 60% of providers increase their resources and 40% use
existing resources.
Low‑cost scenario: 40% increase their resources and 60% use existing resources.
11.26 We use the midpoint of these scenarios as our central estimate.

11.27 In Table 3 below we show our estimates of the additional costs for establishing a form of
UK presence under both scenarios and summarise our assumptions.
Table 3: Estimates of the additional costs for establishing UK presence
Firm size and number of firms
Assumed average FTE resources per firm, person days per year1 Average cost per firm (£)2 Total costs to firms (£) Panel A: High‑cost scenario Providers who increase their resources (eg by hiring new employees) 2 Large 48 for IT; 440 for Governance 214,000 428,000 3 Medium 24 for IT; 220 for Governance 100,000 300,000 7 Small 24 for IT; 220 for Governance 80,000 560,000 Providers who use business‑as‑usual resources (eg by relocating staff) 1 Large 48 for IT; 50 for Governance 44,000 44,000 2 Medium 24 for IT; 25 for Governance 20,000 41,000 5 Small 24 for IT; 25 for Governance 16,000 80,000 Total ongoing costs, per annum 1.45m Panel B: Low‑cost scenario Providers who increase their resources (eg by hiring new employees) 1 Large 48 for IT; 440 for Governance 214,000 214,000 2 Medium 24 for IT; 220 for Governance 100,000 200,000 5 Small 24 for IT; 220 for Governance 80,000 400,000 Providers who use business‑as‑usual resources (eg by relocating staff) 2 Large 48 for IT; 50 for Governance 44,000 88,000 3 Medium 24 for IT; 25 for Governance 20,000 61,000 7 Small 24 for IT; 25 for Governance 16,000 112,000 Total ongoing costs, per annum 1.07m Panel C: Central estimate (mid‑point of high‑ and low‑cost scenarios) Total ongoing costs, per annum 1.26m Total cost, 10‑year PV 10.85m
Table notes:

220 full‑time equivalent (FTE) person days per year equal 1 person working full‑time.
The value of the FTE effort is calculated using our Standardised cost model (SCM). All salaries include an uplift of
21% for overheads.
Figures might not sum because of rounding.

11.28 Overall, we estimate the additional costs to establish a form of UK presence are £1.26m
per year, or £10.85m in PV terms over the 10‑year period. These costs are additional to the rental costs estimated in the CBA. Changes to final rules
11.29 In Table 4 below we summarise the main changes between the consulted proposals and
the final rules and their expected impacts on costs and benefits. Broader consultation feedback resulted in changes to our rules, rather than feedback on the CBA itself.
11.30 We expect the remaining changes, including clarifications to reflect our policy intention,
to have no or negligible impacts on costs and benefits.
Table 4: Impact on the CBA from changes to the final rules
Consulted proposal
Changes to final rules and guidance Impact on CBA Requirement for ESG rating providers to provide disclosures for direct users and rated entities, at both product‑ and individual rating‑level. (Transparency) Individual rating‑level disclosures to direct users may be provided at product‑level where the same information applies across multiple individual ratings. (Chapter 3) Based on our understanding of the sector and consultation feedback, and in the absence of relevant data, we assume that product‑level disclosures will be sufficient for around 15% of individual ratings, because the same information will apply across multiple individual ratings within the same ESG rating product. This implies an estimated 15% reduction in the one‑off and ongoing costs of rating‑level disclosures relative to the CBA estimate. Applying this assumption, we estimate that costs could be reduced by approximately £2.1m in PV terms, comprising £1m in one‑off costs and £1.1m in ongoing costs. We expect no change in benefits, as the initial policy intent would be achieved with a lower operational burden and reduced duplication of certain disclosures.

Consulted proposal
Changes to final rules and guidance Impact on CBA Requirement for ESG rating providers to provide disclosures to rated entities by default. (Transparency) Rated entities that are not ESG rating users may access detailed disclosures on request rather than automatically. (Chapter 3) Based on the consultation feedback, we recognise that the cost estimate of the consultation proposals in our CBA in CP25/34 did not fully reflect the operational burden of providing disclosures to rated entities by default. In response to the feedback, we have amended the final rules to make these disclosures accessible upon request. We consider that the cost estimate in CP25/34 is a reasonable approximation of the lower burden arising under the final rules. Therefore, we have not made further quantitative adjustments to the estimate. Requirement that ESG rating providers keep records of information about the ESG rating that are sufficient to reproduce that rating. (Governance and Systems & Controls) The records should be sufficient to explain and evidence how ESG ratings have been produced and determined. (Chapter 4) We assume a 5% reduction in one‑off and ongoing Governance and Systems & Controls costs. The original estimate comprised five broad cost components (see Table 17 of our CBA), and we assume that each represents 20% of the total cost for Governance and Systems & Controls. We also assume that the amended requirement reduces the record‑keeping component by approximately 25%, principally through lower storage requirements for large datasets. This is equivalent to a 5% reduction in the overall estimate. This reduces the estimated costs by £0.8m in PV terms, comprising £0.4m in one‑off costs and £0.4m in ongoing costs. We expect no change in benefits as the initial policy intent would be achieved with lower operational burden. Requirement that ESG rating providers notify users and rated entities of material methodology changes before they come into effect. (Governance and Systems & Controls) Notify users only, not rated entities. (Chapter 4) We assume a small reduction in ongoing costs, although it is not reasonably practicable to quantify it. We assume no change in one‑off costs as this policy change affects only material methodology changes that might happen on an ongoing basis. We expect no change in benefits as the initial policy intent would be achieved with lower operational burden.

Consulted proposal
Changes to final rules and guidance Impact on CBA Requirement for ESG rating providers to have policies and procedures in place to stop relevant employees from making certain types of personal transactions, and systems in place to ensure employees’ awareness of their firm’s personal transaction policies. (Based on rules for investment firms in COBS 11.7). (Governance and Systems & Controls/ Conflicts of Interest) Providers must have arrangements to prevent certain types of personal transactions and a policy that sets out these restrictions and who they apply to. This policy should be proportionate to the nature, scale and complexity of the firm’s business model. (Chapter 5) Based on the consultation feedback, we recognise that the cost estimate of the consultation proposals in our CBA in CP25/34 did not fully reflect their operational burden. In response to the feedback, we have also amended the final rules to have a personal transactions policy and to allow for more flexibility for providers to implement controls proportionate to the nature, scale and complexity of each provider’s business model. We consider that the cost estimate in CP25/34 is a reasonable approximation of the lower burden arising under the final rules. Therefore, we have not made further quantitative adjustments to the estimate.

Annex 1
Regime summary and changes from the original proposals The table below sets out a summary of the regime, with changes from CP25/34 underlined. This does not include the full detail of the requirements or the changes. Firms must refer to the full final rules in Appendix 1, in addition to this Policy Statement, to understand the full detail of our final rules.
Table 1: Summary of approach to final rules, FCA Handbook reference and
relevant Chapter in this Policy Statement
Topic
Summary of key features of the final rules for ESG rating providers Additions or changes from CP25/34 are underlined Handbook
Chapter
Where you can find more detail in this document Baseline Standards Relevant FCA Handbook rules and guidance apply. These include:

Guidance on the Threshold Conditions
(COND)
Principles for Business (PRIN)
Systems and Controls (SYSC)
Senior Managers and Certification Regime
(SM&CR)
General Provisions (GEN)
Financial Crime Guide (FCG).
COND,
PRIN, SYSC,
SUP, GEN,
FCG
Chapter 2
Transparency • Make minimum public disclosures about their ESG rating products.
Provide additional disclosures to users
about products and individual ratings and provide rated entities with access to these disclosures on request.
Notify users of material methodology
changes.
Further rule changes and new guidance:
Some additions and refinements to
disclosures to the public and for ESG rating users and rated entities.
Clarifications on the level of detail
expected in disclosures, the approach to onward sharing and the trade secrets exemption. ESG 6 Chapter 3

Topic
Summary of key features of the final rules for ESG rating providers Additions or changes from CP25/34 are underlined Handbook
Chapter
Where you can find more detail in this document Governance • Maintain governance arrangements that ensure clear accountability.

Retain operational responsibility for the
ESG rating process, including ability to oversee, review and direct changes where necessary.
Maintain written agreements where
functions are outsourced, with some restrictions on what activities can be outsourced.
Have a sufficient presence and
accountability in the UK.
ESG 6,
SYSC,
COND
Chapter 4
Systems & controls
Have effective policies and processes to
ensure effective quality assurance, data validation and methodology reviews.
Retain records that evidence and explain
how ESG ratings have been produced and ratings outcomes reached. SYSC, ESG 6
Chapter 4
Conflicts of interest
Identify, prevent, manage and disclose
conflicts of interest to maintain the integrity or independence of an ESG rating.
Have a conflicts of interest policy and
update senior management at least yearly.
Have a personal transactions policy and
have appropriate arrangements in place to prevent contravening MAR or damaging the integrity or independence of an ESG rating. ESG 6 Chapter 5 Stakeholder engagement
Notify the rated entity with sufficient time
prior to making available that rating for the first time (2 business days at a minimum). This notification must contain certain information about the rating and how to communicate with the provider.
Provide the rated entity, on request,
with the data used to produce their rating, at any time before or after its rating has been issued. Providers may proceed to publish a rating while the subject is reviewing data.
Have appropriate procedures for receiving
and processing feedback.
ESG 6 Chapter 6

Topic
Summary of key features of the final rules for ESG rating providers Additions or changes from CP25/34 are underlined Handbook
Chapter
Where you can find more detail in this document Complaints • Maintain effective complaints policies and procedures.

Investigate complaints and maintain
appropriate records.
Use complaints information to identify
and address recurring or systemic issues where appropriate.
ESG 6 Chapter 6
Perimeter
Guidance
We have updated our perimeter guidance and examples to explain further our interpretation of the scope of the regime. PERG
Annex H
Chapter 8

Annex 2
List of respondents
We are obliged to include a list of the names of respondents to our consultation who have consented to the publication of their name. That list is as follows:
AIMA
Alpha Beta Partners
Amelia Lo
Aviva
Barnett Waddingham
BeZero Carbon
Bloomberg
Building Societies Association
CDP Worldwide
Chartered Governance Institute
UK & Ireland
Climate Arc
Ecovadis
Eiris Foundation
Equifax
ESG Book GmBH
Ethical and Environmental Screening
Services Ltd
European Association of Sustainability
Rating Agencies (EASRA)
Fathom
Financial Services Consumer Panel
Future of Sustainable Data
Alliance (FoSDA)
FuturePlus Technologies Limited
GC100
Hymans Robertson LLP
Iceberg Data Lab
IdealRatings, Inc.
Impact Cubed
In Accord
Inrate Ltd
Institution of Occupational Safety and
Health (IOSH)
Intercontinental Exchange Inc. (ICE)
International Regulatory Strategy
Group (IRSG)
The Investor Relations Society
Jet2 Plc
Lane Clark & Peacock (LCP)
Listing Authority Advisory
Panel (LAAP)
Lloyds Banking Group
M&G Investments
Matthew Rodhouse
Minerva Analytics
Morningstar Sustainalytics
MSCI
Neuberger Berman
Norges Bank Investment Management
Otto Starzmann
PensionBee
People’s Partnership

Personal Investment Management &
Financial Advice Association (PIMFA)
Principles for Responsible
Investment (PRI)
Quilter plc
Raymond James Wealth Management
RepRisk
Royal London
Russell Investments
S&P Global
Schroders
Severn Trent PLC
Shared Assessments
SRI Services
SSE plc
Standard Chartered
Startup Coalition
SynTao Green Finance Co., Ltd.
The Association of Investment
Companies (AIC)
The Investment Association
The Payments Association
The Society of Pension
Professionals (SPP)
Transition Valuation Project
UK Finance
UK Sustainable Investment and
Finance Association (UK SIF)
UN Working Group on Business and
Human Rights
Joel Shapiro, University of Oxford
Ehsan Azarmsa, University of
Illinois Chicago
Virgin Media
WeeFin
Wesleyan Assurance Society
Worthstone
XPS Group
Yorkshire Building Society

Annex 3
Measuring success
Our Approach

The aim of this regime is to improve the transparency and reliability of ESG ratings.
We expect this to support better‑informed decision making by users and increased confidence in the ESG ratings market. In turn, this will further the FCA’s objective of building market integrity.
We will consider the regime successful if it leads to fewer concerns about the quality and
reliability of ESG ratings, as well as conflicts of interest. Alongside this, improved trust and confidence in ESG ratings will also represent a successful outcome. Our survey carried out in 2024 (see our Research Note) serves as a baseline for user experience in the market. For example, we found that 48% of users faced transparency‑related challenges and 55% of users considered there were shortcomings in the systems and controls of ESG rating providers.
We will monitor these outcomes through a combination of supervisory engagement,
market analysis, stakeholder feedback and data collected through our regulatory reporting framework. This approach builds on existing requirements and practices to minimise additional burden on firms.
We know it may be difficult to isolate the impact of our rules from regulatory
developments in overseas jurisdictions, such as the EU, that will affect ESG rating providers with global presence.
We will focus on the following outcomes:

Greater transparency and understanding: users and rated entities should have a
clearer understanding of ESG ratings, including how they are produced and what they are intended to measure.
Robust governance, systems and controls: firms should have effective governance
arrangements, quality assurance processes and controls for managing conflicts of interest.
Confidence in ESG ratings: users of ESG ratings should have greater confidence that
ESG ratings are robust and reliable, and produced in line with the standards required by the regime.

Our regulatory reporting framework will support supervision and help us to assess
whether the regime is delivering its intended outcomes. The reporting framework is being developed over a longer time period to allow for live testing and refinement before it is finalised (Chapter 10). It will be designed to collect data that supports supervisory monitoring and enables trend analysis over time.
Subject to final development, data and metrics collected through regulatory reporting
could include information relating to methodology updates, complaints data, and product reviews to support measuring success. In considering any complaints data collected, we will explore whether more detailed information such as complaint categories would provide useful insights.
Success will include better outcomes for users of ESG ratings and rated entities,
including through effective complaints handling, and evidence of providers having stronger governance, systems and controls and transparency. We will also seek to identify trends in these areas, as well as the level of confidence in the market, through stakeholder engagement, market intelligence and other supervisory evidence.
We will also monitor market participation from smaller providers and competition
developments in the market. Our supervisory oversight and market monitoring will seek to maintain the proportionality of our approach and help maintain healthy competition and innovation. Low competition and poor customer outcomes in the provision of ESG ratings could undermine trust and confidence in the market for sustainable financial products. Given ESG data and ratings are widely used in investment decision making, it is evident that a well‑functioning ESG ratings market is needed to ensure well-informed capital allocation decisions. A regime that promotes healthy competition in ESG ratings will therefore make a significantly positive contribution to the wider operation of the ESG ratings market.
As part of the FCA’s Rule Review Framework, we are providing an additional way for
stakeholders to provide evidence where they feel that our rules are not achieving their intended outcomes, as set out above, once implemented. This can be done using the online stakeholder feedback form on our website.

Annex 4
Updated Compatibility Statement
Compliance with legal requirements

In CP25/34, our compatibility statement concluded that introducing a regulatory
framework for ESG rating providers was compatible with certain requirements under the Financial Services and Markets Act 2000 (FSMA) as well as our statutory objectives, secondary international competitiveness and growth objective, and regulatory principles. That analysis was informed by the evidence available at consultation stage and remains valid.
Following consultation, we have made a number of targeted changes to our proposals in
response to stakeholder feedback. These include refinements to certain transparency, stakeholder engagement, record‑keeping and personal transaction requirements in response to stakeholder feedback.
These changes were particularly informed by feedback relating to operational burden,
proportionality, implementation challenges, and the need to accommodate different business models and market participants.
We consider that these changes improve the proportionality of the regime and continue
to be consistent with the regulatory principles in section 3B FSMA. We consider these changes reduce unnecessary operational burden while preserving the policy intent of improving transparency, accuracy and trust in ESG ratings.
The final rules continue to promote transparency, reliability and confidence in
ESG ratings. They maintain the core regulatory outcomes consulted on, including requirements relating to governance, transparency, conflicts of interest, systems and controls, stakeholder engagement and complaints handling.
However, these changes do not affect the compatibility statement published in CP25/34.
Equality and diversity considerations
We have considered the equality and diversity issues that may arise from the proposals
in this Policy Statement.
We do not consider that the final rules adversely impact any of the groups with
protected characteristics under the Equality Act 2010. This remains consistent with the assessment set out in CP25/34 and is not affected by the changes made to the final rules.

Environmental, social & governance considerations
9. In developing this Policy Statement, we have considered the environmental, social and
governance (ESG) implications of our proposals and our duty under sections 1B(5) and 3B(c) of FSMA to have regard to contributing towards the Secretary of State achieving compliance with the net‑zero emissions target under section 1 of the Climate Change Act 2008 and environmental targets under section 5 of the Environment Act 2021.
10. As set out in CP25/34, bringing ESG rating providers within the regulatory perimeter is
intended to improve transparency, quality and trust in ESG ratings. This should increase their potential to drive positive change, for example, helping investors and other market participants in making better informed decisions, including where ESG ratings are used to assess sustainability‑related risks and opportunities.
11. We consider that the changes made in this Policy Statement do not alter the
assessment set out in CP25/34 and do not materially affect the ESG considerations underlying our proposals.

Annex 5
Abbreviations used in this paper
Abbreviation Description
AI Artificial Intelligence
CBA Cost Benefit Analysis
COBS Conduct of Business Sourcebook
COCON Code of Conduct Sourcebook
COND Threshold Conditions Sourcebook
CP Consultation Paper
DEPP Decision Procedure and Penalties Manual DPB Designated Professional Body ENFG Enforcement Guidance ESG Environmental Social Governance EU European Union FCA Financial Conduct Authority FCG Financial Crime Guide FOS Financial Ombudsman Service FSCS Financial Services Compensation Scheme FSMA Financial Services and Markets Act 2000 GEN General Provisions Sourcebook ICMA International Capital Market Association IOSCO International Organization of Securities Commissions PASS Pre‑Application Support Service

Abbreviation Description
PERG Perimeter Guidance Manual
PR Prescribed Responsibility
PRIN Principles for Businesses Sourcebook
PS Policy Statement
SI Statutory Instrument
SMF Senior Managers Functions
SM&CR Senior Managers & Certification Regime SoR Statement of Responsibilities SUP Supervision Manual SYSC Senior Management Arrangements, Systems and Controls Sourcebook TC Threshold Conditions Sourcebook UK United Kingdom

Appendix 1
Made rules (legal instrument)

FCA 2026/69
FOS 2026/7
ENVIRONMENTAL, SOCIAL AND GOVERNANCE RATINGS INSTRUMENT 2026 Powers exercised by the Financial Conduct Authority A. The Financial Conduct Authority (“the FCA”) makes this instrument in the exercise of the powers and related provisions in or under:
(1) the following sections of the Financial Services and Markets Act 2000 (“the Act”):
(a) section 137A (The FCA’s general rules); (b) section 137P (Control of information rules); (c) section 137T (General supplementary powers); (d) section 138D (Actions for damages); (e) section 139A (Power of the FCA to give guidance); (f) section 226 (Compulsory jurisdiction); and (g) paragraph 23 (Fees) of Part 3 (Penalties and fees) of Schedule 1ZA (The Financial Conduct Authority); (2) article 2(2) (Commencement) of the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025 (SI 2025/1349); and (3) the other powers and related provisions listed in Schedule 4 (Powers exercised) to the General Provisions of the FCA’s Handbook. B. The rule-making powers listed above are specified for the purpose of section 138G(2) (Rule-making instruments) of the Act. Consent and approval by the FCA
C. The FCA approves the making of the Voluntary Jurisdiction rules and guidance and
the fixing and varying of the standard terms for Voluntary Jurisdiction participants by the Financial Ombudsman Service Limited, as set out at paragraph D below. Powers exercised by the Financial Ombudsman Service Limited D. The Financial Ombudsman Service Limited (“Financial Ombudsman Service”) makes and amends the rules and guidance for the Voluntary Jurisdiction, and fixes and varies the standard terms for Voluntary Jurisdiction participants, as set out in Annex G to this instrument, and to incorporate the changes to the Glossary of definitions as set out in Annex A to this instrument, in the exercise of the following powers and related provisions in the Act:
(1) section 227 (Voluntary jurisdiction);
(2) paragraph 8 (Information, advice and guidance) of Part II (The Scheme Operator) of Schedule 17; (3) paragraph 18 (Terms of reference to the scheme) of Part IV (The Voluntary Jurisdiction) of Schedule 17; and

FCA 2026/69
FOS 2026/7
(4) paragraph 20 (Voluntary jurisdiction rules: procedure) of Part IV of Schedule 17. E. The making and amendment of the Voluntary Jurisdiction rules and guidance and the fixing and varying of the standard terms for Voluntary Jurisdiction participants by the Financial Ombudsman Service, as set out at paragraph D above, is subject to the approval of the FCA.

Commencement
F. Part 1 of Annex D comes into force on 3 November 2026.
G. All other parts of this instrument come into force on 29 June 2028.

Amendments to the FCA Handbook
H. The modules of the FCA’s Handbook of rules and guidance listed in column (1) below are amended in accordance with the Annexes to this instrument listed in column (2). (1) (2) Glossary of definitions Annex A Principles for Businesses sourcebook (PRIN) Annex B Senior Management Arrangements, Systems and Controls sourcebook (SYSC)
Annex C
Fees manual (FEES) Annex D
Environmental, Social and Governance sourcebook (ESG) Annex E Supervision manual (SUP) Annex F Dispute Resolution: Complaints sourcebook (DISP) Annex G

Amendments to materials outside the Handbook
I. The Perimeter Guidance manual (PERG) is amended in accordance with Annex H to
this instrument.

Notes
J. In the Annexes to this instrument, the notes (indicated by “Note:” or “Editor’s note:”) are included for the convenience of the reader but do not form part of the legislative text. Citation K. This instrument may be cited as the Environmental, Social and Governance Ratings Instrument 2026. By order of the Board of the Financial Ombudsman Service 26 October 2026

FCA 2026/69
FOS 2026/7
By order of the Board of the FCA
22 October 2026

FCA 2026/69
FOS 2026/7
Annex A
Amendments to the Glossary of definitions
In this Annex, underlining indicates new text and striking through indicates deleted text, unless otherwise stated. Insert the following new definitions in the appropriate alphabetical position. The text is not underlined. ESG rating (a) An assessment that:
(i) fulfils the definition of an ‘ESG rating’ in article 63Z7 of the Regulated Activities Order; and (ii) is within scope of the regulated activity specified in article 63U of the Regulated Activities Order (ESG ratings). (b) For ease of reference, an ‘ESG rating’ according to article 63Z7 of the Regulated Activities Order is an assessment regarding 1 or more environmental, social or governance factors, which:
(i) is produced in the form of an opinion, a score or a combination of both, where:
(A) ‘score’ means a measure derived from data and a pre-established statistical or algorithmic system or model, without additional substantial analytical input from an analyst; and (B) ‘opinion’ means an assessment involving substantial analytical input from an analyst; and (ii) is prepared using an established methodology and a defined ranking system of ratings categories, whether or not it is characterised as an ESG rating. ESG rating process the complete process of producing and directly distributing an ESG rating, including, but not limited to:
(a) the design of the ESG rating product-line; (b) the development, monitoring and review of the relevant methodology; (c) the sourcing, validation and quality control of the data used to produce an ESG rating; (d) the synthesis and analysis of the data to produce the ESG rating;

FCA 2026/69
FOS 2026/7
(e) the quality control of the ESG rating; (f) the direct distribution of the ESG rating; (g) monitoring the ESG rating; and (h) communicating with ESG rating users and notifiable persons, including administering contracts and dealing with complaints. ESG rating product-line the type of ESG ratings produced according to a single methodology. ESG rating provider a firm with permission to carry on the regulated activity of providing an ESG rating. ESG rating user a person who has:
(a) paid an ESG rating provider for the use of an ESG rating; or (b) accessed an ESG rating directly from an ESG rating provider for free. methodology a system of models, techniques and procedures for producing an ESG rating product-line. notifiable person a person reasonably identifiable by an ESG rating provider who is:
(a) the issuer of a rated item;
(b) a body corporate or other legal person, if that person is a rated item; (c) a UK AIFM, where the AIF is a rated item; (d) a SEF manager in relation to any SEF that it manages, where the SEF is a rated item; or (e) a RVECA manager in relation to any RVECA that it manages, where the RVECA is a rated item. providing an ESG rating the regulated activity specified in article 63U of the Regulated Activities Order, which, in summary, means producing and making available an ESG rating, where that rating is likely to influence a decision to make a specified investment, unless the provider could not reasonably have expected it to do so, whether the ESG rating is solicited or unsolicited. rated item the subject of an ESG rating. rating category has the meaning in article 63Z7 of the Regulated Activities Order, which (for ease of reference) is ‘includes, but is not limited to, a variable or division within a system, such as a letter, number, symbol, colour or

FCA 2026/69
FOS 2026/7 temperature, that provides a relative measure to distinguish one or more characteristics of various rated items’. Amend the following definitions as shown. [Editor’s note: further changes to ‘branch’ will take place on 3 April 2028 (see FCA 2026/52).] branch … (i) … [Note: article 4(1)(c) of AIFMD] (j) (in relation to an ESG rating provider) a place of business which is
part of an ESG rating provider that has no legal personality and
provides the services for which the ESG rating provider has been authorised. conflicts of interest policy (1) (except in MAR 8 and ESG 6) the policy established and maintained in accordance with SYSC 10.1.10R; and. (2) … (3) (in ESG 6) the policy established and maintained in accordance with ESG 6.5.12R. [Editor’s note: further changes to ‘client’ will take place on 25 October 2027 (see FCA 2026/35 and FCA 2026/45) and on 3 April 2028 (see FCA 2026/52).] client … (B) In the FCA Handbook:
…
(12)
(a) (in ESG, except ESG 6) in addition to (1), includes:
(i) a unitholder or potential unitholder in a scheme; and (ii) to the extent not within (i), an investor or potential investor in an AIF. (b) (in ESG 6) the same as in (1) but does not include a potential client.

FCA 2026/69
FOS 2026/7 director (1) (except in COLL, DTR, UKLR, PRM and MAR 5-A) (in relation to any of the following (whether constituted in the United Kingdom or under the law of a country or territory outside it)):
…
(c) (in SYSC, APER, COCON, MIPRU 2, (Responsibility for insurance distribution and MCD credit intermediation activity), CASS 10A (Payment services and electronic money: resolution pack), CASS 15 (Payment services and electronic money: relevant funds), SUP 3A (Payment services and electronic money), SUP 10A (FCA Approved persons in Appointed Representatives), and SUP 10C (FCA senior managers regime for approved persons in SMCR firms) and ESG 6 (Conduct rules for ESG rating providers) a partnership; … … [Editor’s note: The definitions of ‘regulated activity’ and ‘retail market business’ take into account the changes introduced by the Glossary (Cryptoassets) Instrument 2026 (FCA 2026/35), which come into force on 25 October 2027.] regulated activity … (B) in the FCA Handbook:
(1) (in accordance with section 22 of the Act (Regulated activities)) the activities specified in Part II (Specified activities), Part 3A (Specified activities in relation to information) and Part 3B (Claims management activities in Great Britain) of the Regulated Activities Order, which are, in summary:
…
(tv) advice, investigation or representation in relation to an employment-related claim (article 89M); and (tw) … (tx) providing an ESG rating (article 63U); and … (2) in DISP, except DISP 1.1, DISP 1.2, DISP 1.3 and DISP 1.9: (in accordance with the FCA’s power under section

FCA 2026/69
FOS 2026/7
226 of the Act) all of the activities included in (B)(1) as at 25 October 2027 29 June 2028, unless expressly excluded in DISP 2.3.1R. retail market business the regulated activities and ancillary activities to those activities, payment services, issuing electronic money, and activities connected to the provision of payment services or issuing of electronic money, of a firm in a distribution chain (including a manufacturer and a distributor) which involves a retail customer, but not including the following activities:
…
(6) insurance distribution activities carried on by a firm in respect of a group policy that:
…
(c) do not involve any direct contact between the firm and that person; and (7) the activities specified as designated activities under section 71K (Designated activities) of the Act by regulations 7 (Designated activities: public offers of qualifying cryptoassets) and 8 (Designated activities: admissions to trading on a qualifying cryptoasset trading platform) of the Cryptoassets Regulations, where:
…
(b) those activities are carried on in relation to a qualifying cryptoasset that is not a UK qualifying stablecoin.; and (8) providing an ESG rating and any ancillary activity to that activity.

FCA 2026/69
FOS 2026/7
Annex B
Amendments to the Principles for Businesses sourcebook (PRIN) In this Annex, underlining indicates new text and striking through indicates deleted text. 3 Rules about application …
3.4 General
Clients and the Principles
3.4.-1 R PRIN 3.4.1R, PRIN 3.4.2R and PRIN 1 Annex 1 do not apply with respect to:
…
(5) the issuing of electronic money (where not a regulated activity).; or (6) providing an ESG rating. …

FCA 2026/69
FOS 2026/7
Annex C
Amendments to the Senior Management Arrangements, Systems and Controls sourcebook (SYSC) In this Annex, underlining indicates new text and striking through indicates deleted text. 1 Application and purpose … 1 Annex 1 Detailed application of SYSC … 1 Annex 1
Part 2
Part 2 Application of the common platform requirements
(SYSC 4 to 10)
…
What?
…
2.9 G The application of the provisions on the conflicts of interest in
SYSC 10 is set out in SYSC 10.1.-4G to SYSC 10.1.1AR, SYSC 10.1.1BR and SYSC 10.2.1R. … 1 Annex 1
Part 3
[Editor’s note: further changes to SYSC 1 Annex 1 Part 3 will take place on 25 October 2027 (see FCA 2026/44 and FOS 2026/5).]
Part 3 Tables summarising the application of the common platform
requirements to different types of firm
…
Other firms
…

FCA 2026/69
FOS 2026/7
3.3 R For all other firms:
(1) (Subject to (3)) SYSC 4 to SYSC 10 apply as rules or as guidance in accordance with Column B in Table A below in the following way:
(a) where a rule is shown modified in Column B as ‘Guidance’, it should be read as guidance (as if “should” appeared in that rule instead of “must”); and (b) the provision should be applied in a proportionate manner, taking into account the nature, scale and complexity of the firm’s business. (2) … (3) SYSC 10 does not apply to ESG rating providers. …
Table A: Application of the common platform requirements in SYSC 4 to 10
1 Annex 1
Table A
…
Provision
SYSC 6
Column A
Application to a common platform firm other than to a UCITS investment firm COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a fullscope UK AIFM of an authorised AIF Column B Application to all other firms apart from insurers, UK ISPVs, managing agents, the Society, full-scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms … SYSC 6.3.9R Rule For firms carrying on a credit-related regulated activity or regulated claims management activity, or operating an electronic system in

FCA 2026/69
FOS 2026/7 relation to lending, applies only where the Money Laundering Regulations apply to the firm. Rule does not apply to a firm with a limited permission for entering into a regulated credit agreement as lender. Rule does not apply to a firm for which a professional body listed in Schedule 1 to the Money Laundering Regulations, and not the FCA, acts as the supervisory authority for the purposes of those regulations (FCA Handbook only). Rule does not apply to a firm carrying on regulated pensions dashboard activity. Rule does not apply to a firm carrying on the regulated activity of providing an ESG rating. … … Provision SYSC 8 Column A Application to a common platform firm other than to a UCITS investment firm COLUMN A+ Application to a UCITS management company COLUMN A++ Application to a fullscope UK AIFM of an authorised AIF Column B Application to all other firms apart from insurers, UK ISPVs, managing agents, the Society, full-scope UK AIFMs of unauthorised AIFs, MiFID optional exemption firms and third country firms …

FCA 2026/69
FOS 2026/7
SYSC
8.1.1R
Rule Rule for a
UCITS investment firm; otherwise guidance
Not applicable
Guidance - but applies as a rule to an ESG rating provider … … … 6 Compliance, internal audit and financial crime
6.1 Compliance
…
Compliance function
…
6.1.4C R …
(2) This rule applies to:
(a) a debt management firm; and
(b) a credit repair firm.; and
(c) an ESG rating provider.
…
…
6.3 Financial crime
…
The money laundering reporting officer
6.3.9 R A firm (with the exception of a sole trader who has no employees and an
ESG rating provider) must:
(1) appoint an individual as MLRO, with responsibility for oversight of its compliance with the FCA’s rules on systems and controls against money laundering; and

FCA 2026/69
FOS 2026/7
(2) ensure that its MLRO has a level of authority and independence within the firm and access to resources and information sufficient to enable him them to carry out that responsibility. … 8 Outsourcing
8.1 General outsourcing requirements
…
General requirements
8.1.1 R A common platform firm and an ESG rating provider must:
…
…
10 Conflicts of interest
10.1 Application
…
General application
…
10.1.1A R This section also applies to:
(1) a full-scope UK AIFM of:
…
(c) a non-UK AIF; and.
(2) …
10.1.1B R This section does not apply to an ESG rating provider. …

FCA 2026/69
FOS 2026/7
Annex D
Amendments to the Fees manual (FEES)
In this Annex, underlining indicates new text and striking through indicates deleted text.
Part 1: Comes into force on 3 November 2026
3 Application, Notification and Vetting Fees … 3 Annex Authorisation fees payable 3 Annex R [Editor’s note: further changes to FEES 3 Annex 1 will take place on 25 October 2027 (see FCA 2026/58) and 29 June 2028 (see Part 2 of this Annex).] …
Part 2 – Pricing categories applicable to applications made in the following
activity groupings in the A, B, C, CC and CMC fee blocks Activity grouping Description Applicable pricing category in FEES 3 Annex 1AR … A.26 … … A.27 Providing an ESG rating (unless in scope of the item below). Providing an ESG rating, where the provider has a forecast (as provided in the course of the application) of revenue for doing this activity of £500,000, or over, for the 12-month period following the day of submission of the application. …

FCA 2026/69
FOS 2026/7
…
…
4 Periodic fees
…
4 Annex
1A
FCA activity groups, tariff bases and valuation dates 4 Annex 1A R [Editor’s note: further changes to FEES 4 Annex 1A will take place on 25 October 2027 (see FCA 2026/58).]
Part 1
This table shows how the FCA links the activities (for which a firm has permission or designation) to activity groups (fee-blocks). A firm can use the
table to identify which fee-blocks it falls into based on its permission or its
other activities.
Activity group Fee payer falls in the activity group if:
…
A.26 Cryptoasset activities
…
A.27 ESG rating providers it is applying for permission for providing an ESG rating. For the purposes of this activity group ‘providing an ESG rating’ means the ESG ratings activity provided for in article 6 of the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025 (SI 2025/1349) which will be article 63U of the Regulated Activities Order and a regulated activity from 29 June 2028. … …
Part 2: Comes into force on 29 June 2028

FCA 2026/69
FOS 2026/7
3 Application, Notification and Vetting Fees … 3 Annex Authorisation fees payable 3 Annex R …
Part 2 – Pricing categories applicable to applications made in the following
activity groupings in the A, B, C, CC and CMC fee blocks Activity grouping Description Applicable pricing category in FEES 3
Annex 1AR
…
A.27 Providing an ESG rating (unless in scope of the item below). ESG rating providers Providing an ESG rating, where the provider has a forecast (as provided in the course of the application) of revenue for doing this activity of £500,000, or over, for the 12-month period following the day of submission of the application. … … … 4 Periodic fees … 4 Annex 1A FCA activity groups, tariff bases and valuation dates 4 Annex 1A R

FCA 2026/69
FOS 2026/7
Part 1
This table shows how the FCA links the activities (for which a firm has permission or designation) to activity groups (fee-blocks). A firm can use the
table to identify which fee-blocks it falls into based on its permission or its
other activities.
Activity group Fee payer falls in the activity group if:
…
A.27 ESG rating providers it is applying for permission for providing an ESG rating For the purposes of this activity group ‘providing an ESG rating’ means the ESG ratings activity provided for in article 6 of the Financial Services and Markets Act 2000 (Regulated Activities) (ESG Ratings) Order 2025 (SI 2025/1349) which will be article 63U of the Regulated Activities Order and a regulated activity from 29 June 2028 its permission includes providing an ESG rating. … …

FCA 2026/69
FOS 2026/7
Annex E
Amendments to the Environmental, Social and Governance sourcebook (ESG) In this Annex underlining indicates new text and striking through indicates deleted text, unless otherwise stated. 1 Purpose and application
1.1 Purpose and application
Purpose
1.1.1 G The ESG sourcebook sets out:
(1) the rules and guidance concerning a firm’s approach to environmental, social and governance matters.; and (2) the conduct rules and guidance for ESG rating providers. …
1.1.5 G …
1.1.6 G ESG 6 contains the conduct rules and guidance for ESG rating providers.
These include rules and guidance about transparency, governance, systems and controls, and conflicts of interest.
1.2 General application
…
1.2.4 G (1) The table at ESG 1.2.4G(2) provides a general overview as to how
the rules in ESG 2, ESG 4, and ESG 5 and ESG 6 apply to firms. (2) This table belongs to ESG 1.2.4G(1). Type of firm Applicable provisions … Distributors ESG 4.1.1R(1); ESG 4.1.16R to ESG 4.1.19R; ESG 4.3.1R. An ESG rating provider ESG 6 …

FCA 2026/69
FOS 2026/7
Insert the following new chapter, ESG 6, after ESG 5 (Disclosure of sustainability-related information). All the text is new and is not underlined. 6 Conduct rules for ESG rating providers
6.1 Application
6.1.1 R This chapter applies to an ESG rating provider.
6.1.2 G (1) ESG 6 (Conduct rules for ESG rating providers) is the specialist chapter
for firms carrying on the regulated activity of providing an ESG rating. (2) PERG 19 provides guidance on when activities are likely to amount to the regulated activity of providing an ESG rating. (3) The detailed obligations in this chapter build on the high-level obligations elsewhere in the FCA Handbook – for example, in PRIN, GEN, SUP and SYSC.
6.2 Governance, systems and controls
Purpose
6.2.1 G The rules in this section supplement the rules and guidance in SYSC 4 to
SYSC 9. They seek to ensure (among other things) that firms implement and maintain appropriate systems, controls, governance and oversight arrangements to enable them to provide ESG ratings that comply with the requirements of the regulatory system. Systems and controls in relation to the ESG rating process
6.2.2 G Firms are reminded that the rules and guidance in SYSC 4 to SYSC 9 apply, as
set out in the table in SYSC 1 Annex 1 Part 3 3.3R.
6.2.3 R A firm must have robust governance arrangements and systems and controls to
ensure the integrity, independence and reliability of:
(1) the ESG ratings it provides; and
(2) the data it uses in the ESG rating process.
6.2.4 R A firm must implement and maintain clear and effective policies, procedures
and systems to ensure it relies on accurate and up-to-date information when producing an ESG rating. Methodology
6.2.5 R A firm must implement and maintain clear and effective policies, procedures
and systems to:
(1) ensure each ESG rating is consistent with its methodology; and

FCA 2026/69
FOS 2026/7
(2) review the methodology periodically to confirm whether it continues to meet its intended purpose.
6.2.6 R A firm must implement and maintain a process for ensuring that each
methodology is defined, thorough, and applied systematically and consistently.
6.2.7 G Firms are reminded that they are required to make certain notifications in
relation to material changes to a methodology under ESG 6.4.18R. Quality control
6.2.8 R (1) A firm must have adequate human and technical resources to qualitycontrol its ESG rating process periodically.
(2) The quality control referred to in (1) must, at a minimum:
(a) ensure that each ESG rating is produced in line with its methodology and the firm’s processes; (b) where relevant, verify that the data used in the ESG rating process is timely and accurate; (c) check whether feedback received from notifiable persons has been considered; and (d) include a periodic review of its ESG ratings, except where the ESG rating is a point-in-time rating. Outsourcing
6.2.9 G SYSC 8 sets out the rules and guidance that apply to a firm in relation to
outsourcing. In particular:
(1) SYSC 8.1.1R requires an ESG rating provider, among other things, not to undertake the outsourcing of important operational functions in such a way as to impair materially the quality of its internal control. (2) SYSC 8.1.6R makes clear that even if an ESG rating provider outsources critical or important operational functions, or any relevant services and activities, it remains fully responsible for discharging all of its obligations under the regulatory system.
6.2.10 R In addition to its obligations under SYSC 8, a firm must not outsource:
(1) operational responsibility for the ESG rating process; or (2) the performance of its obligations in ESG 6.2.3R and ESG 6.2.6R, except to a member of its group.
6.2.11 G The requirement in ESG 6.2.10R(1) to retain operational responsibility for the
ESG rating process means a firm must be able to take decisions to review any

FCA 2026/69
FOS 2026/7
part of the ESG rating process and ensure any necessary change is made to it,
particularly where such changes are needed for compliance with the regulatory system.
6.2.12 R Where a firm outsources any part of the ESG rating process to any person,
there must be an agreement in writing clearly setting out the responsibilities of each party.
6.2.13 G Firms are reminded that a reference to any person includes entities within the
firm’s group.
Record-keeping
6.2.14 G Firms are reminded of their obligations under SYSC 9 in relation to recordkeeping.
6.2.15 R For the purposes of SYSC 9.1.1R, the requirement to keep orderly records
includes, but is not limited to:
(1) keeping records of the governance process and decision-making involved in the ESG rating process and ESG rating product-lines; (2) keeping such other records as are necessary to allow the ESG rating provider to explain and evidence:
(a) how it produced the ESG rating; and
(b) how it determined the ESG rating;
(3) keeping details of any changes made to methodologies and the reasons for such changes; (4) keeping and regularly updating a record of the kinds of service or activity carried out by, or on behalf of, the firm in which a conflict of interest of the type described in ESG 6.5.1R may arise, or has arisen; (5) keeping records of personal transactions in line with the firm’s personal transactions policy (as required by ESG 6.5.18R(2)(d)); and (6) keeping a record of each complaint received and the measures taken for its resolution.
6.2.16 R If steps taken by a firm under ESG 6.5.7R are not sufficient to ensure, with
reasonable confidence, that material risks of damage to the integrity or independence of an ESG rating will be prevented, the firm must keep a record of the steps taken to manage the conflict.
6.3 Engagement and complaints handling
Notifications

FCA 2026/69
FOS 2026/7
6.3.1 R (1) When a firm decides to produce an ESG rating for the first time, it must
notify all notifiable persons sufficiently in advance of the ESG rating being made available. (2) The notification in (1) must contain:
(a) the nature of the rating;
(b) the methodology that will be used;
(c) a summary of the main types of data that will be used to produce the ESG rating, including whether that data will be forwardlooking or backward-looking; (d) the appropriate contact details for the ESG rating provider; (e) an explanation of the notifiable person’s right to request data under ESG 6.3.4R, and how that request can be made; (f) an explanation of the notifiable person’s right to request the disclosures listed in ESG 6.4.7R and ESG 6.4.10R), and how that request can be made; and (g) an explanation of how to notify the ESG rating provider of any factual errors regarding the ESG rating. (3) For the purposes of (1), the firm must determine what period of time is sufficient to allow notifiable persons to read and understand the information the notification contains, and at the very least, that period must be no less than 2 business days.
6.3.2 G The notification obligation in ESG 6.3.1R(1) only applies prior to the first
time an ESG rating is made available. It does not, therefore, apply to subsequent updates of that ESG rating.
6.3.3 G For the purposes of ESG 6.3.1R(2)(d), ‘appropriate contact details’ means the
contact information for the person or team who is able to deal with queries from a notifiable person, or direct them to someone who can. Obligations where a notifiable person requests data
6.3.4 R On request, a firm must provide a notifiable person with the data used to
assess the characteristics of a rated item.
Procedure for receiving feedback
6.3.5 R A firm must establish and maintain a procedure for receiving and processing
feedback from stakeholders about the accuracy of the ESG rating or elements of the production of an ESG rating. Obligations when requesting data from notifiable persons

FCA 2026/69
FOS 2026/7
6.3.6 R When requesting data from notifiable persons, a firm must:
(1) make clear what data is being requested; (2) make the data request as easy as possible for notifiable persons to comply with; and (3) provide notifiable persons with sufficient time to complete the data request.
6.3.7 G A firm could, for example, make a data request as easy as possible for the
notifiable person to comply with by pre-populating it with information already available from public sources or previous data requests. Complaints handling
6.3.8 R This section applies to a complaint made by an ESG rating user, a notifiable
person or any other person with an interest in an ESG rating (for the purposes of this section, a ‘complainant’).
6.3.9 R For the purposes of this section, a ‘complaint’ means any written expression
of dissatisfaction made by or on behalf of a complainant, concerning any aspect of the ESG rating process and which alleges that the complainant has suffered (or may suffer) financial loss, material distress or material inconvenience.
6.3.10 G The term ‘complaint’ used in this section has the meaning given in ESG
6.3.9R and does not have the same meaning as the term complaint in the Handbook Glossary.
6.3.11 G Firms are reminded of their obligations under SYSC 6.1.1R to establish,
implement and maintain adequate policies and procedures. This includes effective and transparent complaints handling policies and procedures.
6.3.12 R The complaints handling policies and procedures must be:
(1) set out in writing;
(2) clear, accurate and up to date; and
(3) made available to all relevant staff of the firm through appropriate internal channels.
6.3.13 R A firm must publish information on its website about its complaints handling
policy, including:
(1) the procedure for a complainant to make a complaint; (2) how the firm handles complaints;

FCA 2026/69
FOS 2026/7
(3) the contact details of the person or team within the firm responsible for handling complaints; and (4) the expected timeline for handling a complaint.
6.3.14 R It must be free of charge for a complainant to submit a complaint to a firm.
6.3.15 R A firm is only required to deal with a complaint that has been raised within 3
years of the date on which the matter giving rise to the complaint occurred.
6.3.16 G A complaint submitted to the firm after the period described in ESG 6.3.15R
does not have to be investigated by the firm.
6.3.17 R A firm must:
(1) investigate a complaint in a fair and timely manner; and (2) communicate the outcome of its investigation to the complainant within a reasonable period.
6.3.18 R A firm must ensure that conflicts of interest arising in the complaints handling
process are managed in accordance with ESG 6.5.
6.3.19 R A firm must put in place appropriate management controls and take reasonable
steps to ensure that it identifies and remedies any recurring or systemic problems raised by the complaints it receives.
6.3.20 G For the purpose of ESG 6.3.19R, appropriate management controls and
reasonable steps could include:
(1) analysing the causes of individual complaints so as to identify root causes common to types of complaint; and (2) correcting, where reasonable to do so, such root causes.
6.3.21 G Firms are reminded of their record-keeping obligations under SYSC 9 and, in
particular, ESG 6.2.15R(6).
6.4 Transparency
6.4.1 G (1) This section contains rules and guidance on disclosures. These
disclosures are designed to enhance the transparency and comparability of ESG ratings and ESG rating product-lines. (2) Some of the disclosures relate to ESG rating product-lines, which are types of ESG ratings produced according to the same methodology. For example, a firm’s standard ESG risk rating product. (3) Some of the disclosures relate to individual ESG ratings. For example, for the ESG rating product-line in (2), an ESG risk rating of a particular company.

FCA 2026/69
FOS 2026/7
(4) Firms are required to publicly disclose certain minimum information about their ESG rating product-lines (ESG 6.4.2R). (5) Firms are then required to disclose to ESG rating users and, on request, to notifiable persons:
(a) more detailed information about their ESG rating product-lines (ESG 6.4.7R); and (b) information about individual ESG ratings (ESG 6.4.10R). (6) For example, for the ESG rating product-line in (2), a firm that received a request from a notifiable person would have to disclose:
(a) the more detailed information about that ESG rating product-line in ESG 6.4.7R; and (b) the information in ESG 6.4.10R for the relevant ESG rating. (7) Firms are also required to notify ESG rating users about material changes to methodologies. (8) The table below summarises the disclosure requirements in this section. Provision About what? To whom? When? ESG 6.4.2R to ESG 6.4.5G Minimum public disclosures about the firm’s ESG rating productlines The public When an ESG rating productline is made available ESG 6.4.6R to ESG 6.4.8R Additional disclosures about ESG rating product-lines ESG rating users, and notifiable persons on request To an ESG rating user, when they access an ESG rating within the ESG rating product-line for the first time To a notifiable person, as soon as reasonably practicable after receiving their request ESG 6.4.9R to ESG 6.4.14G Additional disclosures about ESG rating users, and notifiable To an ESG rating user, when they

FCA 2026/69
FOS 2026/7 individual ESG ratings persons on request access an ESG rating within the ESG rating product-line for the first time To a notifiable person, as soon as reasonably practicable after receiving their request ESG 6.4.15R to ESG 6.4.17R Information that is not required in ESG 6.4.7R or ESG 6.4.10R but that could be reasonably expected to assist ESG rating users in understanding the firm’s ESG ratings or ESG rating productlines ESG rating users At the time of the disclosures in ESG 6.4.7R and ESG 6.4.10R Minimum public disclosures
6.4.2 R A firm must, at a minimum, publish the following information about each of
its ESG rating product-lines:
(1) the ESG rating product-line’s objective(s), including whether the assessment covers ESG risks, ESG impacts or any other dimensions; (2) a high-level overview of which environmental, social or governance factors are assessed by the methodology; (3) the meaning of its rating scale and rating categories, including what a higher or lower ranking means; (4) whether ESG ratings produced as part of that ESG rating product-line are expressed as absolute values or as a value relative to a peer group; (5) where applicable, how the peer group against which rated items are compared was determined; (6) how the firm determines which rated items are covered by the ESG rating product-line;

FCA 2026/69
FOS 2026/7
(7) where applicable, a summary of the approach to engagement with notifiable persons required under ESG 6.3.1R, ESG 6.3.4R, ESG 6.3.5R, ESG 6.4.6R(2) and ESG 6.4.9R(2), namely:
(a) the fact that the firm will inform notifiable persons of its decision to produce an ESG rating for the first time; (b) that notifiable persons are entitled to request the data used to assess the characteristics of a rated item at any time and how to do this; (c) how to contact the firm to provide feedback about the accuracy of the ESG rating, or elements of the production of an ESG rating; and (d) how notifiable persons can request the disclosures described under ESG 6.4.7R and ESG 6.4.10R; (8) a summary of the methodology, including:
(a) a summary of how the ratings are determined, including, but not limited to, a description of how the factors, key performance indicators, or main data are weighted or aggregated; (b) a breakdown of the factors and key performance indicators; (c) a summary of the main types of data used, including whether that data is forward-looking or backward-looking; (d) a summary of the sources of data used and whether they are public or non-public; (e) whether the assessment is intended to be forward-looking or backward-looking and the timeframe considered; (f) the main assumptions on which the assessment is based; (g) a summary of the main data policies and processes, including those for addressing:
(i) the unavailability of data and, where applicable, the use of data estimates; (ii) data quality and data verification; and (iii) data updates and corrections, including the frequency of data updates; (h) where applicable, an explanation of how artificial intelligence is used in the ESG rating process;

FCA 2026/69
FOS 2026/7
(i) how frequently:
(i) the ESG ratings produced under the ESG rating productline are reviewed to ensure consistency with their methodology as required by ESG 6.2.5R(1); and (ii) the methodology is reviewed under ESG 6.2.5R(2); and (j) the process for notifying ESG rating users regarding any material changes to the methodology, as required by ESG 6.4.18R; (k) the factors the firm will take into account in determining whether a change to the methodology is material; (l) the date and nature of the last material methodology change, and the general impact of such change on the ESG ratings within the ESG rating product-line; and (m) the version number of the current methodology; and (9) any material limitations of the ESG rating product-line identified by the firm, such as data gaps and biases, estimation constraints, and thirdparty dependencies.
6.4.3 G (1) In complying with ESG 6.4.2R(2), the FCA would expect a firm to
explain whether an ESG rating product-line covers a particular type of environmental, social or governance factor, such as biodiversity or human rights. (2) For the purposes of ESG 6.4.2R(5), the FCA would expect a firm to disclose the type of peer group (for example, sector, market or geographical peers). Firms are not required to specify the individual peer group members. (3) For the disclosure in ESG 6.4.2R(6), the FCA would expect firms to include information such as the type of rated items (for example, corporates, funds, bonds, securities or physical assets) and geographical scope. Firms are not required to disclose every rated item covered by the ESG rating product-line. (4) For the disclosures in ESG 6.4.2R(8)(b), examples of the types of factors and key performance indicators include (but are not limited to) greenhouse gas emissions, board independence or property exposure to flood risks. (5) In complying with ESG 6.4.2R(8)(h), the FCA would expect firms to disclose, among other things, the extent of human oversight in the ESG rating process. A firm only needs to disclose limitations relating to artificial intelligence to the extent they are material under ESG 6.4.2R(9).

FCA 2026/69
FOS 2026/7
(6) For the disclosures in ESG 6.4.2R(8)(l), an example of the ‘general impact’ that a material methodology change has had on ESG ratings within the ESG rating product-line could include information such as the portion of rated items that were subject to a rating change as a result of a methodology update. Alternatively, firms could, for example, focus on specific industries or other types of rated items that were particularly affected.
6.4.4 R The disclosures in ESG 6.4.2R must:
(1) be made when an ESG rating product-line is made available; (2) remain available for as long as the ESG rating product-line is available; and (3) be updated as soon as reasonably practicable after any material change to the information required under ESG 6.4.2R.
6.4.5 G Firms are reminded that they are also required to make certain public
disclosures in relation to:
(1) conflicts of interest under ESG 6.5.9R and ESG 6.5.13R; and (2) their complaints handling policy under ESG 6.3.13R. Additional disclosures about ESG rating product-lines
6.4.6 R The disclosures required by ESG 6.4.7R must be made:
(1) to an ESG rating user of an ESG rating within the ESG rating productline; and (2) on request, to a notifiable person in relation to an ESG rating within the ESG rating product-line.
6.4.7 R A firm must disclose the following information in relation to an ESG rating
product-line:
(1) a detailed explanation of the methodology and information about review of the methodology, including:
(a) the policy on methodology review, including the criteria that would trigger a revision and, where applicable, the process for engagement with relevant stakeholders during revision; and (b) the outcome of the most recent methodology review (required by ESG 6.2.5R(2); (2) an overview of the steps taken to mitigate any risks arising from material limitations of the ESG rating process; and

FCA 2026/69
FOS 2026/7
(3) an overview of the steps taken to meet the quality control requirements in ESG 6.2.8R, including the remediation process if quality issues arise.
6.4.8 R The disclosures in ESG 6.4.7R must:
(1) be made:
(a) to an ESG rating user, when they access a rating within the ESG rating product-line for the first time; and (b) to a notifiable person, as soon as reasonably practicable after receiving their request; (2) be updated and provided to an ESG rating user as soon as reasonably practicable after a firm makes a material change to the information required under ESG 6.4.7R; and (3) remain accessible for as long as the ESG rating product-line is available. Additional disclosures about individual ESG ratings
6.4.9 R The disclosures required by ESG 6.4.10R must be made:
(1) to an ESG rating user of an ESG rating within the ESG rating productline; and (2) on request, to a notifiable person for the relevant ESG rating.
6.4.10 R A firm must disclose the following information regarding an ESG rating:
(1) where relevant:
(a) which business activities have been considered; (b) whether and how group entities are taken into account in the determination of the ESG rating; (c) where the ESG rating has been inherited from another entity within the same group, the entity from which the ESG rating has been inherited; and (d) where ESG ratings are expressed as relative to a peer group, a description of the peer group; (2) the factors, key performance indicators and main data used to assess the relevant characteristics of the rated item; (3) where applicable, the weights given to each factor considered under the rating methodology;

FCA 2026/69
FOS 2026/7
(4) where practicable, the source(s) of specific data points that inform the ESG rating or, where that is not practicable, a detailed explanation of those sources; (5) where the firm estimates data, the approach used; (6) where data underlying an ESG rating is absent or unavailable, and the ESG rating provider has not made estimations, how this is handled; (7) when the ESG rating was last updated; and (8) where there has been a material change in either the ESG rating or its data, the reason for the change and an explanation of what the firm considers a material change to be.
6.4.11 G (1) To the extent information required to be disclosed under ESG 6.4.10R
applies across an entire ESG rating product-line, disclosing such information only at the ESG rating product-line level is sufficient. Such disclosures do not need to be repeated for each individual ESG rating. (2) When describing group entities under ESG 6.4.10R(1)(b) and ESG 6.4.10R(1)(c), it is sufficient for firms to include an overview of the main entities covered. For example, a firm could disclose that ‘Company X Ltd and its majority-owned subsidiaries’ were considered. (3) When disclosing the ‘main data’ required in ESG 6.4.10R(2), firms are only expected to disclose data that materially influenced the ESG rating. Firms are not required to disclose every underlying datapoint. (4) Firms may comply with ESG 6.4.10R(5) by disclosing either the calculation used for the estimation or a description of it. (5) Where estimations have not been made, firms may comply with ESG 6.4.10R(6) by describing their approach. For example, firms could explain that they used a value of zero or imposed a specific penalty instead of calculating estimates. (6) For the purposes of ESG 6.4.10R(8), examples of material changes in either the ESG rating or its data could include:
(a) new information becoming available;
(b) a methodology change; or
(c) the correction of an error by the firm.
6.4.12 R The disclosures in ESG 6.4.10R must:
(1) be made:

FCA 2026/69
FOS 2026/7
(a) to ESG rating user, when they access a rating for the first time; and (b) to a notifiable person, as soon as reasonably practicable after receiving their request; (2) be updated and provided to an ESG rating user as soon as reasonably practicable after a firm makes a material change to the information required under ESG 6.4.10R; and (3) remain accessible for as long as the ESG rating is available.
6.4.13 R When complying with the disclosure requirements in ESG 6.4.10R, firms are
not required to provide a separate disclosure document where the relevant information is already disclosed as part of the ESG rating output (for example, the weights for each factor under ESG 6.4.10R(3)).
6.4.14 G Pursuant to ESG 6.4.13R, the disclosures may form part of existing ESG
ratings reports, scorecards or equivalent. Alternatively, they may be disclosed as part of a data feed or be made available via a data platform where ESG rating users can access the ESG ratings. Further disclosures to assist ESG rating users
6.4.15 R The disclosure required by ESG 6.4.16R must be made to an ESG rating user.
6.4.16 R In addition to the disclosures required under ESG 6.4.7R and ESG 6.4.10R, a
firm must disclose any further information that could be reasonably expected to assist an ESG rating user to understand the firm’s ESG rating or ESG rating product-line.
6.4.17 R The disclosure required by ESG 6.4.16R must be made at the same time as the
disclosures in ESG 6.4.7R and ESG 6.4.10R.
Notification of methodology changes to ESG rating users
6.4.18 R (1) Where a firm wishes to make a material change to a methodology, it
must first consider the likely impact on the ESG ratings it has provided in that ESG rating product-line. (2) The firm must then make a notification to all ESG rating users of ESG ratings provided in the ESG rating product-line, clearly explaining:
(a) the nature of the change to the methodology; (b) the reason(s) for it; and (c) a summary of its expected impact on the ESG ratings provided in the ESG rating product-line.

FCA 2026/69
FOS 2026/7
(3) In providing the notification in (2), the firm must give ESG rating users sufficient time to consider the information provided before the change takes effect.
6.4.19 G Examples of factors that a firm may consider in determining whether a change
to a methodology is ‘material’ include:
(1) the likely impact of the change on the firm’s ESG ratings within the ESG rating product-line; (2) whether it will impact an ESG rating, or an ESG rating product-line, which the firm is aware has been integrated into an ESG rating user’s products or services; and (3) whether fundamental characteristics of the methodology are changing, such as the key performance indicators used or weightings applied.
6.4.20 G Where an ESG rating is publicly available, a firm may comply with ESG
6.4.18R(2) by providing a public notification of the material change to the methodology referred to in ESG 6.4.18R(1) – for example, via a public notice or links on the firm’s website. Supplementary provisions
6.4.21 R A firm may provide the disclosures required in ESG 6.4.7R, ESG 6.4.10R and
ESG 6.4.16R by making the relevant information publicly available.
6.4.22 G Firms should consider whether, following an initial request from a notifiable
person, they should offer a means through which the notifiable person can automatically access updates to the disclosures in ESG 6.4.7R and ESG 6.4.10R.
6.4.23 R (1) When a firm permits an ESG rating user to disclose an ESG rating to a
third party, the firm must either:
(a) ensure the ESG rating user is able to share with that third party any information that has been disclosed under ESG 6.4.7R, ESG 6.4.10R and ESG 6.4.16R; or (b) provide that information directly to the third party. (2) The rule in (1):
(a) only applies where such information can reasonably be expected to assist the third party in understanding the disclosed ESG rating; and (b) does not require a firm to share proprietary information provided by a third-party supplier if doing so would breach restrictions imposed by the supplier as to the onward sharing of such information.

FCA 2026/69
FOS 2026/7
(3) The exception in (2)(b) does not apply where the third party is part of the same group as the ESG rating provider.
6.4.24 G An example of where ESG 6.4.23R(2)(b) would apply is where a data provider
supplies its proprietary data to an ESG rating provider to enable the production of an ESG rating about another company. The data provider and the ESG rating provider are not part of the same group. If their contract prohibits the onward sharing of the proprietary data, the ESG rating provider would not be required to disclose the data, or to permit its disclosure under ESG 6.4.23R(1). Manner of disclosure and notification
6.4.25 R A firm must provide the information required in this section in a manner that
is:
(1) easily accessible, prominent and free to obtain; (2) in a written format that is clearly presented and easy to understand; and (3) accurate, fair and not misleading.
6.4.26 G When making disclosures under this section, a firm should consider what
information could be reasonably expected to assist recipients in understanding the disclosures. Intellectual property rights and proprietary information
6.4.27 R (1) The provisions of this section do not require a firm to disclose
information that would qualify as trade secrets as defined in regulation 2 of the Trade Secrets (Enforcement, etc.) Regulations 2018 (SI 2018/597). (2) Where a firm relies on the exemption in (1), it must instead disclose the extent to which it is unable to make the relevant disclosures.
6.4.28 G When complying with ESG 6.4.27R(2), firms are not expected to disclose
information that may itself compromise trade secrets. A high-level explanation will be sufficient to justify reliance on the exemption in ESG 6.4.27R(1).
6.5 Conflicts of interest
Types of conflicts
6.5.1 R The rules and guidance in this section relate to conflicts of interest that entail
a material risk of damage to the integrity or independence of an ESG rating or a firm’s operations – for example, by influencing the opinions, analysis or judgement of the firm, or its officers or employees, involved in the ESG rating process.

FCA 2026/69
FOS 2026/7
6.5.2 G To ensure ESG ratings are independent within the meaning of ESG 6.5.1R,
they should be free from political or economic interference.
6.5.3 R For the purposes of identifying the types of conflict of interest that arise, or
may arise, at any point in the ESG rating process, a firm must take into account, as a minimum:
(1) the firm’s organisational structure and business or financial activities, including different business lines; (2) where the firm is a member of a group, any circumstances that may give rise to a conflict of interest resulting from the structure and business or financial activities (including different business lines) of other members of the group; (3) whether the firm’s ESG rating charging model may create conflicts of interest; (4) whether the firm provides other services to a notifiable person; (5) the ESG rating process and the methodology used to produce an ESG rating; (6) whether an employee or officer of the firm, has a financial or other incentive connected to any aspect of the ESG rating process; and (7) the extent to which performance and evaluation of employees or officers could create conflicts of interest or otherwise affect the independence or integrity of its ESG ratings.
6.5.4 G For the purposes of ESG 6.5.3R(1) and (2), a firm should consider all relevant
business lines within its group for any conflicts that arise, or may arise, including where the firm provides:
(1) consulting services that could reasonably give rise to a conflict with a firm’s provision of ESG ratings; (2) accountancy or audit services; or (3) other regulated activities.
6.5.5 G (1) Examples of ESG rating charging models referred to in ESG 6.5.3R(3)
are:
(a) the user-pays model; and
(b) the issuer-pays model.
(2) An example of the kind of conflict that could arise in relation to a firm’s ESG rating charging model is where the firm uses an issuer-pays

FCA 2026/69
FOS 2026/7 model for ESG rating product-lines, leading to pressure from the client or relationship with the client to give favourable ratings. Identifying conflicts of interest
6.5.6 R A firm must take all appropriate steps to identify conflicts of interest that arise
or may arise at any point in the ESG rating process.
Managing conflicts of interest
6.5.7 R A firm must establish and maintain effective systems and controls that enable
it to take all reasonable steps to prevent or manage conflicts of interest. Record of conflicts
6.5.8 G Firms are reminded that there are requirements in relation to record-keeping
for conflicts of interest in ESG 6.2.15R(4) and ESG 6.2.16R.
Disclosure of conflicts
6.5.9 R (1) If steps taken by a firm under ESG 6.5.7R are not sufficient to ensure,
with reasonable confidence, that material risks of damage to the integrity or independence of an ESG rating will be prevented, the firm must publish the following:
(a) a description of the conflict of interest; (b) the sources of that conflict of interest; (c) an explanation of the material risks that arise as a result of the conflict of interest; and (d) the steps taken to mitigate those risks. (2) The disclosure must:
(a) comply with the requirements of ESG 6.4.25R; and (b) clearly state that the systems and controls established by the firm to prevent such conflicts are not sufficient to ensure, with reasonable confidence, that the material risks of damage to the integrity or independence of the ESG rating will be prevented. (3) Disclosures made under (1) which are based on confidential information may, for the purposes of (1)(a), be described in summary form, but should include sufficient detail to enable the recipient to understand the nature of the conflict and its potential impact.
6.5.10 G Where a requirement to make a disclosure under ESG 6.5.9R arises, such
disclosure should be made as soon as reasonably practicable.
6.5.11 G Disclosing conflicts of interest in accordance with ESG 6.5.9R does not:

FCA 2026/69
FOS 2026/7
(1) exempt a firm from the obligation to establish and maintain the effective systems and controls to prevent or manage conflicts of interest under ESG 6.5.7R; or (2) enable a firm to over-rely on such disclosure without adequate consideration as to how conflicts may be appropriately managed. Conflicts of interest policy
6.5.12 R (1) A firm must implement and maintain in writing an effective conflicts of
interest policy that is appropriate to the size and organisation of the firm and the nature, scale and complexity of its business. (2) The conflicts of interest policy must include the following:
(a) it must identify, in accordance with ESG 6.5.1R, the circumstances which constitute or may give rise to a conflict of interest entailing a material risk of damage to the integrity or independence of an ESG rating; and (b) it must specify policies and procedures to be followed, and measures to be adopted, in order to:
(i) prevent those conflicts in accordance with ESG 6.5.7R; and (ii) record and disclose conflicts in accordance with ESG 6.2.15R(4), ESG 6.2.16R (where relevant) and ESG 6.5.9R. (3) A firm must assess and periodically review, at least annually, its conflicts of interest policy and must take all appropriate measures to address any deficiencies (such as over-reliance on disclosure of conflicts of interest).
6.5.13 R A firm must publish its conflicts of interest policy, or a summary of its
conflicts of interest policy.
Conflicts of interest report
6.5.14 R A firm must ensure that its governing body receives written reports on a
regular basis, and at least annually, on all situations referred to in ESG 6.2.15R(4) and, where relevant, ESG 6.2.16R. Information barriers
6.5.15 R (1) When a firm establishes and maintains an information barrier between
different parts of its business, to the extent that the business of one of those parts involves carrying on any part of the ESG rating process, it may:
(a) withhold or not use the information held; and

FCA 2026/69
FOS 2026/7
(b) for that purpose, permit persons employed in the first part of its business to withhold the information held from those employed in the other part of the business. (2) Information may also be withheld or not used by a firm when this is required by an established arrangement maintained between different parts of the business (of any kind) in the same group. (3) For the purpose of this rule, ‘maintains’ includes taking reasonable steps to ensure that the arrangements remain effective and are adequately monitored, and must be interpreted accordingly.
6.5.16 R When a firm manages a conflict of interest using an information barrier under
ESG 6.5.15R, individuals on the other side of the barrier will not be regarded as being in possession of knowledge denied to them as a result of the information barrier. Personal transactions
6.5.17 R (1) A firm must implement and maintain adequate arrangements aimed at
preventing any specified person from entering into a personal transaction that would:
(a) contravene the Market Abuse Regulation; or (b) damage the integrity or independence of an ESG rating. (2) For the purposes of this section, ‘specified persons’ are relevant persons involved in the ESG rating process who the firm considers:
(a) could materially influence an ESG rating; or (b) could, in the course of business, have access to inside information about a rated item.
6.5.18 R (1) A firm must implement and maintain in writing an effective personal
transactions policy that is appropriate to the size and organisation of the firm, and the nature, scale and complexity of its business. (2) The policy referred to in (1) must set out:
(a) the nature of any restrictions on personal transactions; (b) the specified persons to whom any such restrictions apply; (c) how the firm will:
(i) make relevant persons aware of the personal transactions policy; and

FCA 2026/69
FOS 2026/7
(ii) make specified persons aware of their responsibilities under the personal transactions policy; and (d) the kinds of records that the firm considers should be retained in accordance with its obligations under SYSC 9. (3) A firm must assess and periodically review, at least annually, its personal transactions policy and must take all appropriate measures to address any deficiencies.
6.5.19 G For the purposes of ESG 6.5.18R(2)(b), a firm may specify individuals by
name or by reference to roles that would ordinarily fall within the scope of the policy. Insert the following new schedules, ESG Sch 1 to ESG Sch 3, after ESG TP 1 (Transitional provisions). All the text is new and is not underlined. Sch 1 Record keeping requirements Sch 1.1 G (1) The aim of the guidance in the following table is to give the reader a quick overall view of the relevant record keeping requirements. (2) It is not a complete statement of those requirements and should not be relied on as if it were. Handbook reference Subject of record Contents of record When record must be made Retention period ESG 4.1.6R Record keeping for sustainability labels Requirement for a manager that uses a sustainability label to prepare a record as to the basis on which the sustainability label has been used When using a sustainability label Record must be kept for the duration of the sustainability label’s use, including where the use of the sustainability label changes ESG 4.1.12R Reviews of sustainability label use Requirement for a manager to keep a record of the fact that it has undertaken a review under ESG 4.1.11R and the decision it has At the time of review under ESG 4.1.11R None specified

FCA 2026/69
FOS 2026/7 reached as a result of the review ESG 5.2.8R Consumerfacing disclosure Requirement for a manager to keep a copy of each version of its published consumer-facing disclosure When a new version is published 5 years ESG 6.2.15R ESG rating process, ESG ratings and ESG rating product-lines Requirement to keep orderly records for ESG rating providers Includes but is not limited to keeping records of:
(a) Records of governance process and decision-making Ongoing None specified (b) Other records necessary to evidence how the rating was produced and determined Ongoing None specified (c) Details of changes made to methodologies and the reasons When a methodology is changed None specified (d) Kinds of service or activity that may give rise or has given rise to a conflict of interest Ongoing – to be updated regularly None specified (e) Records of personal transactions Ongoing None specified (f) Each complaint received and the measures taken for its resolution When a complaint is received or measures are taken None specified ESG 6.2.16R Conflicts of interest – management Requirement for firms to retain a record of the steps taken to When steps are taken to None specified

FCA 2026/69
FOS 2026/7 manage a conflict where damage to integrity or independence of the ESG rating cannot be prevented manage a conflict Sch 2 Notification requirements Sch 2.1 G (1) The aim of the guidance in the following table is to give the reader a quick overall view of the relevant notification requirements. (2) It is not a complete statement of those requirements and should not be relied on as if it were. Handbook reference Matter to be notified Contents of the notification Trigger event ESG 4.1.7R Use or revision of, or ceasing to use, a sustainability label Notify the FCA of intention to use a sustainability label in relation to a particular sustainability product, or to revise or cease the use of that label using the FCA’s online notification and application system Intention to use a sustainability label in relation to a particular sustainability product, or to revise or cease the use of that sustainability label. Sch 3 Right of action for damages Sch 3.1 G The table below sets out the rules in ESG the contravention of which by an authorised person may be actionable under section 138D of the Act (Actions for damages) by a person who suffers loss as a result of the contravention. Sch 3.2 G If a ‘Yes’ appears in the column headed ‘For private person?’ the rule may be actionable by a private person under section 138D of the Act (or, in certain circumstances, their fiduciary or representative; see article 6(2) and (3)(c) of the Financial Services and Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256)). A ‘Yes’ in the column headed ‘Removed’ indicates that the FCA has removed the right of action under
section 138D(3) of the Act. Where this is the case, a reference to the rule
in which it is removed is also given.
Sch 3.3 G The column headed ‘For other person?’ indicates whether the rule may be actionable by a person other than a private person (or their fiduciary or representative) under article 6(2) and (3) of the Financial Services and

FCA 2026/69
FOS 2026/7
Markets Act 2000 (Rights of Action) Regulations 2001 (SI 2001/2256). Where this is the case, an indication of the type of person by whom the rule may be actionable is given.
Chapter Section/Annex Paragraph Right of action under section 138D
For private person?
Removed? For other person?
All of the rules in ESG Yes No No

FCA 2026/69
FOS 2026/7
Annex F
Amendments to the Supervision manual (SUP) In this Annex, underlining indicates new text and striking through indicates deleted text. 16 Reporting requirements
16.1 Application
…
Application of different sections of SUP 16 (excluding SUP 16.13, SUP 16.14A, SUP 16.15, SUP 16.22 and SUP 16.26)
16.1.3 R
[Editor’s note: further changes to SUP 16.1.3R will take place on 18 March 2027 (see FCA 2026/6) and 25 October 2027 (see FCA 2026/44 and FOS 2026/5).] (1)
Section(s)
(2) Categories of firm to which section applies (3) Applicable rules and guidance … SUP 16.4 and SUP 16.5 All categories of firm except: Entire sections … (jd) a firm with permission to carry on only the regulated activity of providing an ESG rating; (k) a firm falling within a combination of (i), (ia), (j), (ja), (jb), and (jc) and (jd).; (l) … (m) a firm that only has permissions to carry on the regulated activity of administering a benchmark and providing an ESG

FCA 2026/69
FOS 2026/7 rating, but no other permission.
…
…
16.26 Reporting of information about Directory persons
Application
16.26.1 R This section of the FCA Handbook applies to an SMCR firm but it does not
apply to a pure benchmark SMCR firm or to a firm with permission to carry on only the regulated activity of providing an ESG rating. …
16.30 Baseline Financial Resilience Report
Application
16.30.1 R This section applies to any firm except:
…
(5) a supervised run-off firm; and
…
(7) a firm with permission to carry on only providing targeted support.; and (8) a firm with permission to carry on only the regulated activity of providing an ESG rating. …

FCA 2026/69
FOS 2026/7
Annex G
Amendments to the Dispute Resolution: Complaints sourcebook (DISP) In this Annex, underlining indicates new text and striking through indicates deleted text. [Editor’s note: This Annex takes into account the changes made by the Cryptoassets (Conduct and Firms Standards) Instrument 2026 (FCA 2026/44 and FOS 2026/5), which come into force on 25 October 2027.] 1 Treating complainants fairly
1.1 Purpose and application
…
Application to firms
…
1.1.5 R This chapter does not apply to:
…
(6) a depositary, for complaints concerning activities carried on for an AIF that is:
…
(b) another type of AIF unless it is:
…
(iii) a charity AIF; and
(7) complaints in respect of administering a benchmark.; and (8) complaints in respect of providing an ESG rating. … 1 Annex Application of DISP 1 to type of respondent/complaint 1 Annex G …

FCA 2026/69
FOS 2026/7
Type of respondent / complaint
DISP 1.1A
Requirements for MiFID investment firms
DISP 1.2
Consumer awareness rules
DISP 1.3
Complaints handling rules
DISP 1.4 -
1.8
Complaints resolution rules etc.
DISP 1.9
Complaints record rule
DISP 1.10
Complaints reporting rules
DISP 1.10A
Complaints data publication rules
DISP 1.10B
Complaints reporting directions
… complaints relating to administering a benchmark … … … … … … … … complaints relating to providing an ESG rating Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply Does not apply

FCA 2026/69
FOS 2026/7
…
2 Jurisdiction of the Financial Ombudsman Service …
2.3 To which activities does the Compulsory Jurisdiction apply?
Activities by firms
2.3.1 R The Ombudsman can consider a complaint under the Compulsory
Jurisdiction if it relates to an act or omission by a firm in carrying on one or more of the following activities:
(1) regulated activities (other than auction regulation bidding, administering a benchmark and, dealing with unwanted asset money and providing an ESG rating); … …
2.5 To which activities does the Voluntary Jurisdiction apply?
2.5.1 R The Ombudsman can consider a complaint under the Voluntary Jurisdiction
if:
…
(2) it relates to an act or omission by a VJ participant in carrying on one or more of the following activities:
(a) an activity other than:
…
(xv) arranging deals in qualifying cryptoassets; and (xvi) arranging qualifying cryptoasset staking),; and (xvii) providing an ESG rating, … … (c) activities, other than:
…
(xv) arranging deals in qualifying cryptoassets; and

FCA 2026/69
FOS 2026/7
(xvi) arranging qualifying cryptoasset staking,; and (xvii) providing an ESG rating, which (at 25 October 2027 29 June 2028) would be covered by the Compulsory Jurisdiction, if they were carried on from an establishment in the United Kingdom (these activities are listed in DISP 2 Annex 1G); … … 2 Annex Regulated Activities for the Voluntary Jurisdiction at 25 October 2027 29 June 2028 2 Annex G … The activities which were covered by the Compulsory Jurisdiction (at 25 October 2027 29 June 2028) were:
(1) for firms:
(a) regulated activities (other than auction regulation bidding, administering a benchmark and, dealing with unwanted asset money and providing an ESG rating); … … The activities which (at 25 October 2027 29 June 2028) were regulated activities were, in accordance with section 22 of the Act (Regulated Activities), any of the following activities specified in Part II and Parts 3A and 3B of the Regulated Activities Order (with the addition of auction regulation bidding, administering a benchmark and dealing with unwanted asset money):
…
(38F) …
(38G) providing an ESG rating (article 63U); …

FCA 2026/69
FOS 2026/7
Annex H
Amendments to the Perimeter Guidance manual (PERG) In this Annex, underlining indicates new text and striking through indicates deleted text, unless stated otherwise. 1 Introduction to the Perimeter Guidance manual …
1.4 General guidance to be found in PERG
…
1.4.2 G Table: list of general guidance to be found in PERG.
[Editor’s note: further changes to PERG 1.4.2G will take place on 25 October 2027 (see FCA 2026/58).]
Chapter Applicable to: About:
…
PERG 18: Guidance on regulated cryptoasset activities … … PERG 19: Guidance on the scope of the environmental, social and governance ratings regime Any person who needs to know whether their activities in relation to providing ESG ratings will amount to regulated activities. The scope of the regulated activities relating to providing ESG ratings. … 2 Authorisation and regulated activities …
2.4 Link between activities and the United Kingdom
…
2.4.10 G …
2.4.11 G (1) A person will need a permission for providing an ESG rating where
the person is:

FCA 2026/69
FOS 2026/7
(a) located in the United Kingdom and providing an ESG rating to a person, irrespective of whether that person is located in the UK, or overseas (see also PERG 19.5); or (b) not located in the United Kingdom but providing an ESG rating to a person in the UK for remuneration (see also PERG 2.8.14GG(11) and PERG 19.5). (2) ‘located in the United Kingdom’ is defined in article 63Z7 of the Regulated Activities Order as:
‘(a) in relation to a legal person—
(i) the person’s registered office is in the United Kingdom, or, if the person does not have a registered office, the person’s head office is in the United Kingdom, or (ii) the person’s registered office is outside of the United Kingdom (or, if the person does not have a registered office, the person’s head office is outside of the United Kingdom) but it is providing or receiving the ESG rating (as the case may be) through an establishment maintained by it in the United Kingdom, and (b) in relation to a natural person, means a person who is able to satisfy the requirements of the statutory residence test as set out in Schedule 45 to the Finance Act 2013 at the time that the ESG rating is made available to them’. …
2.7 Activities: a broad outline
…
Regulated cryptoasset activities
2.7.20O G …
Providing ESG ratings
2.7.20P G Providing an ESG rating is a regulated activity under article 63U of the Regulated Activities Order (ESG ratings). Guidance on this regulated activity is in PERG 2.8.14GG and PERG 19 (Guidance on the scope of the environmental, social and governance ratings regime). …
2.8 Exclusions applicable to particular regulated activities

FCA 2026/69
FOS 2026/7
…
Regulated cryptoasset activities
2.8.14E G …
Providing ESG ratings
2.8.14F G For further guidance on the activity of providing an ESG rating and the exclusions set out in PERG 2.8.14GG, see PERG 19. 2.8.14G G The regulated activity of providing an ESG rating is cut back by various exclusions as follows:
(1) Regulated products and services (article 63V of the Regulated Activities Order). Where a person provides an ESG rating in the course of carrying on another regulated product or service, this activity does not constitute the regulated activity of providing an ESG rating. However, the exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG
19.6.8. For the purpose of this exclusion, regulated products and
services means:
(a) another activity which is carried on in accordance with a Part 4A permission and is:
(i) a regulated activity; or
(ii) an ancillary service;
(b) an activity for which a person is subject to approval by the FCA under a provision of assimilated law or legislation restated by virtue of section 4 (Power to restate and modify saved legislation) of the Financial Services and Markets Act 2023; (c) an activity that is within scope of a market access arrangement; and (d) an activity in relation to:
(i) a scheme recognised for the purpose of Part 17 of the Act; or (ii) an AIF which is marketed under regulation 58 (Marketing of AIFs managed by small third country AIFMs) or 59 (Marketing of AIFS managed by other third country AIFMs) of the Alternative Investment Fund Managers Regulations 2013. (2) Unregulated benchmarks (article 63W of the Regulated Activities Order). A person will not be carrying on the regulated activity of

FCA 2026/69
FOS 2026/7 providing an ESG rating where it provides that ESG rating in the course of providing a benchmark that is unregulated as a result of
Article 2(2)(a) to (g) of the benchmarks regulation. However, this
exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG 19.6.8. (3) Unregulated credit ratings (article 63X of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is used to produce, or is incorporated in, any of the following, which are unregulated as a result of Article 2(2) of the CRA Regulation:
(a) an unregulated credit rating;
(b) an unregulated credit score; or
(c) an unregulated credit scoring system or similar assessment related to obligations arising from a consumer, commercial or industrial relationship, however, this exclusion does not apply where the ESG rating is provided as a standalone product or service – see PERG 19.6.8. (4) Intra-group ratings (article 63Y of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides the ESG rating to another member of its group and where it does not reasonably expect the ESG rating to be made available outside its group, except in the course of carrying on an activity mentioned in PERG 2.8.14GG(1)(a) to (d). (5) Private use (article 63Z of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides an ESG rating to a third party pursuant to a contract with that third party and:
(a) where the ESG rating relates solely to the third party; and (b) the person does not reasonably expect the ESG rating to be made available outside the third party’s group. (6) Ancillary non-commercial provision (article 63Z1 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where it provides an ESG rating in the course of journalistic, academic or charitable activities and where either:
(a) there is no relevant remuneration (see PERG 19.6.9); or (b) the ESG rating is provided on an occasional or one-off basis and not regularly updated or maintained in a way that would enable it to be relied upon on an ongoing basis.

FCA 2026/69
FOS 2026/7
(7) Public authorities, central banks and international organisations (article 63Z2 of the Regulated Activities Order). Public authorities, central banks and international organisations that provide ESG ratings are not considered to be carrying on the regulated activity of providing an ESG rating. In this context, ‘international organisation’ means any body or bodies the members of which comprise states including the UK. ‘State’ includes a public authority of a state. (8) Accreditation or certification (article 63Z3 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is developed exclusively for accreditation or certification processes and the purpose of that accreditation or certification is not to influence a decision to make a specified investment. (9) Regulatory or legal requirement (article 63Z4 of the Regulated Activities Order). A firm will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided solely for the purpose of complying with its own regulatory or legal requirements. (10) Proxy advice (article 63Z5 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided as part of the provision of proxy advisor services within the meaning given in regulation 2 of the Proxy Advisors (Shareholders’ Rights) Regulations 2019 (SI 2019/926). (11) Overseas person (article 63Z6 and 72 of the Regulated Activities Order). A person will not be carrying on the regulated activity of providing an ESG rating where the ESG rating is provided by a person located overseas to a person ‘located in the United Kingdom’ (see PERG 2.4.11G) where the overseas person receives no remuneration for the ESG rating from any person (see also PERG 19.5.1). … 2 Annex Regulated activities and permission regime … 2 Table
Table 1: Regulated Activities (excluding PRA-only activities) [See note 1 to
Table 1]
Regulated activity Specified investment in relation to which the regulated activity (in the

FCA 2026/69
FOS 2026/7 corresponding section of column one) may be carried on … Activities relating to structured deposits (zag) dealing in investments as agent (article 21) (zah) arranging (bringing about) deals in investments (article 25(1)) (zai) making arrangements with a view to transactions in investments (article 25(2)) (zaj) managing investments (article 37) [see note 3 to Table 1] (zak) advising on investments (except P2P agreements) (article 53(1)) structured deposits Activities relating to ESG ratings (zal) providing an ESG rating (article 63U) Any specified investment … Insert the following new chapter, PERG 19, after PERG 18 (Guidance on regulated cryptoasset activities). All the text is new and is not underlined. 19 Guidance on the scope of the environmental, social and governance ratings regime
19.1 Application
19.1.1 This guidance applies to any person who needs to know whether their activities
in relation to providing environmental, social and governance (ESG) ratings amount to the regulated activity of providing an ESG rating.
19.2 Purpose
19.2.1 Question 2.1: What is the purpose of these questions and answers (Q&As)
and who should be reading them?
This guidance is issued under section 139A of the Act (Guidance). These Q&As supplement the guidance in PERG 2.4.11G, PERG 2.7.20PG and PERG 2.8.14GG. The purpose of these Q&As is to help persons to consider whether they are carrying on the regulated activity of providing an ESG rating and

FCA 2026/69
FOS 2026/7 therefore whether they need authorisation or, for persons that are already FCAauthorised, a variation of their Part 4A permission. The Q&As in this chapter cover:
(1) an overview of the questions a person should consider when deciding whether authorisation is required (see PERG 19.3); (2) the regulated activity of providing an ESG rating and how to apply it (see PERG 19.4); (3) the territorial scope of the regime (see PERG 19.5); (4) the exclusions in articles 63V to 63Z6 of the Regulated Activities Order (see PERG 19.6); and (5) the exemption for designated professional bodies (see PERG 19.7.1).
19.2.2 Question 2.2: To what extent can we rely on these Q&As?
The answers given in these Q&As represent the FCA’s views but the interpretation of financial services legislation is ultimately a matter for the courts. The Q&As explain particular aspects of regulatory requirements. They are not a complete statement of a firm’s obligations and are not a substitute for reading the relevant legislation. If you have doubts about your position after reading the legislation and these Q&As, you may wish to seek legal advice.
19.3 Authorisation for providing an ESG rating
19.3.1 Question 3.1: What questions should we consider to decide whether
authorisation is required?
A person who wants to know whether their proposed activities require authorisation will need to consider the following questions (these questions are a summary of the issues to be considered):
(1) Will I be carrying on my activities by way of business (see PERG 2.3 (The business element))? (2) If so, will I be producing an ‘ESG rating’ (see PERG 19.4.1 and PERG 19.4.6)? (3) If so, will the ESG rating be likely to influence a decision to make a specified investment and could I reasonably have expected this to be the case (see PERG 19.4.10)? (4) If so, am I either:
(a) providing those services from the UK to persons anywhere; or (b) providing those services from abroad to persons in the UK?

FCA 2026/69
FOS 2026/7
(See PERG 19.5 (Territorial scope)).
(5) If so, do any exclusions apply to me (see PERG 2.9 (on exclusions applicable in certain circumstances) and PERG 2.8.14GG for a full list of all the exclusions for the activity of providing an ESG rating, and PERG
19.6 for further guidance in relation to some of them)?
(6) If not, do any exemptions (see PERG 2.10) apply – for example, the exemption for designated professional bodies (see PERG 2.10.12G to PERG 2.10.16G and PERG 19.7.1)? If a person’s answers to (1) to (4) are all ‘yes’ and the answers to questions (5) and (6) are ‘no’, that person requires authorisation and should refer to the FCA website page ‘How to apply for authorisation or registration’ for details of the application process.
19.4 Providing ESG ratings
19.4.1 Question 4.1: What is an ESG rating?
According to article 63Z7 of the Regulated Activities Order, an ESG rating is ‘an assessment regarding one or more ESG factors, which– (a) is produced in the form of an opinion, a score or a combination of both, where– (i) ‘score’ means a measure derived from data and a pre-established statistical or algorithmic system or model, without additional substantial analytical input from an analyst, and (ii) ‘opinion’ means an assessment involving substantial analytical input from an analyst, and (b) is prepared using an established methodology and a defined ranking system of rating categories’. It makes no difference for these purposes whether the assessment is characterised as an ESG rating (see PERG 19.4.2). An ESG factor is defined in the legislation as ‘an environmental, social or governance factor’. This, along with the definition of an ‘ESG rating’, makes clear that an assessment regarding one or more environmental, social or governance factors is potentially within scope of the regulated activity. For example, an assessment of the governance of a company could be within scope. But so could an assessment of the environmental, social and governance performance of that company (or any combination of those factors).
19.4.2 Question 4.2: What does ‘whether or not it is characterised as an ESG
rating’ mean in this context?

FCA 2026/69
FOS 2026/7
A product can be in scope even if it is not described or marketed as an ‘ESG rating’. For example, a product marketed as an ‘ESG data product’ or an ‘ESG solution’ could meet the statutory definition. As could a ‘resilience assessment’ or a ‘transition score’.
19.4.3 Question 4.3: Where is the line between an ESG data product (out of scope)
and an ESG rating (in scope)?
The key distinction between an ESG rating and an ESG data product is that data products do not have a defined ranking system. Examples of ESG data products include ESG news feeds and datasets of corporate CO₂ emissions that are not linked to any ranking system. In contrast, examples of products that are likely to be ESG ratings include ones that assess ESG controversies and assign scores, colour-coded systems (such as red, amber or green), or other categories that enable ranking. The following table sets out examples of hypothetical ESG data products and ESG rating products. These are illustrative examples only; the precise analysis will turn on the facts of each case:
Example type ESG data product ESG ratings product Numerical metrics and indicators Provides standalone numerical indicators or metrics that describe ESG characteristics but leave interpretation to the user. Example: the product shows that Company A has a lost time injury frequency (a health and safety measure) of 4.3 per million hours worked. Numerical indicators are presented alongside assessments that are part of a defined ranking system. Example: the product shows that Company A has a lost time injury frequency rate of 4.3 per million hours worked. This corresponds to a score of 8 on a 0-10 scale, or is classified as poor on a scale of:
outstanding – strong – comparable – poor – very poor.
Carbon-related outputs Supplies quantitative carbon information (eg, emissions figures, emissions trajectories, or temperature alignment calculations) without Classifies or ranks entities based on quantitative carbon data values. Example: the product shows that Company A has estimated scope 3

FCA 2026/69
FOS 2026/7 categorisation or assessment.
Example: the product shows that Company A has estimated scope 3 carbon emissions of XXX tonnes of carbon dioxide equivalent (‘CO2e’) per unit of production. carbon emissions of XXX tonnes CO2e per unit of production, which translates to a score of 8 on a 0-10 scale in the context of its industry. Aggregation and methodology Uses aggregation or calculation techniques solely to organise or present information, without reaching an overall evaluative conclusion. Example: the product shows that Company A derives X% of its revenue from markets with a certain type of regulation. Aggregates, weights or interprets ESG information to arrive at an assessment about ESG performance. Example: the product shows that Company A derives X% of its revenue from markets with a certain type of regulation. This translates to a risk exposure score of 5 out of 10, which is classified as moderate risk on a scale of low – moderate – high. Portfolio-level outputs Provides a deterministic calculation derived from underlying data using a fixed formula, without expressing an overall judgement. Example 1: the product shows that a portfolio has weighted average exposure to tobacco related revenues of 6%. No further qualification or classification of this information is provided. Example 2: the product shows that a portfolio has total carbon emissions of 500m tonnes of CO2e. No further qualification Produces a score, band or label representing the provider’s assessment of the portfolio’s overall ESG performance. Example: the product shows that this portfolio has weighted average exposure to tobacco - related revenues of 6% and is therefore classified as misaligned to Sustainable Development Goals (SDG) 3, on a scale of: very misaligned – misaligned – neutral – aligned – very aligned. Example 2: the product shows that this portfolio

FCA 2026/69
FOS 2026/7 or classification of this information is provided. has total carbon emissions of 500m tonnes of CO2e. This corresponds to a qualitative ranking relative to a benchmark, on a scale of: outstanding – strong – comparable – poor – very poor. Platforms and tools Offers a platform that enables users to access ESG indicators, filter data, or run user-defined calculations, where outputs depend on user inputs rather than provider judgement. Example 1: the product allows the user to see the relevant lost time injury frequency (a health and safety measure) per million hours worked. This is presented as a number with no further classification or assessment. Example 2: the product allows a user to calculate a weighted average carbon footprint for their portfolio. The result is presented as a numeric value, with no further classification or assessment. Offers a platform that produces default scores, rankings or classifications using the provider’s own methodology and presented as the provider’s assessment. Example 1: the product allows the user to see that Company A has a lost time injury frequency rate of 4.3 per million hours worked. This corresponds to a score of 8 on a 0-10 scale, or is classified as poor on a scale of: outstanding – strong – comparable – poor – very poor. The user can determine the lost time injury frequency rate goal of interest (for example, 3.0) and can set the thresholds that align to levels of concern. However, the tool also includes default methodologies, including thresholds and assessments. Example 2: the product allows the user to see how their portfolio’s weighted average carbon footprint compares to a benchmark of other designated portfolios,

FCA 2026/69
FOS 2026/7 with the results ranked. It also includes functionality to score the results for each portfolio based on the user’s choice among 3 set methodologies developed by the provider. Binary values Provides a binary output based on a set of fixed data criteria. Example: The product indicates that a company ‘passes’ or ‘fails’ a fossil fuel screen because its revenue is above or below a set threshold. Provides a binary output value alongside a ranked score or set of categories. Example: the product indicates that a company does or does not have revenue from green products (‘yes’ or ‘no’) and also provides a company assessment ranging from light green to standard green to deep green based on the type of products and amount of revenue.
19.4.4 Question 4.4: What is an established methodology?
A ‘methodology’ is a system of models, techniques and procedures for producing a type of ESG rating. It must involve a system; the methodology cannot involve an unsystematic opinion. A methodology is ‘established’ if it is used to produce an ESG rating productline. Documented procedures are likely to be indicative of an established methodology. However, a methodology can still be ‘established’ even where the models, techniques or procedures have not been documented.
19.4.5 Question 4.5: What are rating categories and what does it mean for there
to be a ‘defined ranking system of rating categories’?
Under the Regulated Activities Order, ‘rating categories’ include (but are not limited to) variables or divisions within a system. Examples include colour coding, scores, or other classes expressed using words (for example ‘aligned’, ‘misaligned’ and ‘strongly aligned’), symbols, numbers (including temperatures), grades or letters. To be in scope, ESG ratings must use rating categories within a predefined ranking system. That system needs to provide a relative measure to distinguish one or more characteristics between rated items. Simply having data where some outputs are higher or lower than others would not by itself amount to a

FCA 2026/69
FOS 2026/7 defined ranking system, even if data users, for example, interpret a higher number to be better or worse than a lower number.
19.4.6 Question 4.6: What does it mean to produce an ESG rating?
Producing an ESG rating means making an assessment regarding one or more ESG factors to produce an ESG score, opinion or combination of both. This remains the case even if some steps are outsourced to group companies or third parties.
19.4.7 Question 4.7: What is the regulated activity in relation to providing ESG
ratings?
Providing an ESG rating is a regulated activity (under article 63U of the Regulated Activities Order). As with other regulated activities, authorisation is only required if the activity is carried on ‘by way of business’ (see PERG 2.3). To be within scope of the regulated activity of providing an ESG rating:
(1) the provider must both produce the rating and make it available (mere distribution of someone else’s ESG rating is out of scope); and (2) the rating must be likely to influence a decision to make a specified investment. It is immaterial whether someone commissioned the ESG rating (ie, it is solicited) or no-one commissioned the rating (ie, it is unsolicited).
19.4.8 Question 4.8: Who needs FCA authorisation to provide ESG ratings?
If you provide ESG ratings (see PERG 2.7.20PG and PERG 19.4.7G) by way of business (see PERG 2.3), you will need FCA authorisation (see PERG 19.3 and PERG 19.4) unless:
(1) you could not reasonably have expected the ESG rating to influence a decision to make a specified investment (see PERG 19.4.10G); (2) you are an exempt person (see PERG 2.10 and PERG 19.7.1); or (3) a Regulated Activities Order exclusion applies (see PERG 2.9, (on exclusions applicable in certain circumstances) PERG 2.8.14GG and PERG 19.6).
19.4.9 Question 4.9: What does making a specified ‘investment’ mean in this
context?
‘Make’, in relation to ‘making a specified investment’, is defined in article 63Z7 of the Regulated Activities Order. It has a broad meaning, including (but not limited to):
‘(a) buying, selling, subscribing for, exchanging, redeeming, holding or underwriting the investment; or

FCA 2026/69
FOS 2026/7
(b) exercising or not exercising any right conferred by such an investment to buy, sell, subscribe for, exchange or redeem such an investment’. ‘Make’ should therefore be read consistently with the relevant specified investment. For example, using an ESG rating to decide whether to enter into a contract of insurance is a decision to ‘make a specified investment’.
19.4.10 Question 4.10: What does ‘likely to influence a decision to make a specified
investment’ mean?
(1) In determining whether an ESG rating is likely to influence a decision to make a specified investment, and whether the provider could reasonably have expected this to be the case, relevant considerations could include, among other factors:
(a) the product’s target users and audience; (b) whether the users use the ratings for their activities in the financial services industry (most uses in that context would be informing a decision to make a specified investment); (c) how the rating is marketed, presented and described; (d) where and how it is distributed or embedded into information services, platforms or other software, particularly ones directed at financial services market participants; and (e) contractual terms governing acceptable use. (2) Examples of ESG ratings that would be likely to influence a decision to make a specified investment include where:
(a) a provider produces an ESG rating on a publicly traded financial instrument or a fund; (b) a company commissions a rating for its initial public offering (IPO) documentation or pre-IPO; (c) a provider sells access to a sustainability portfolio analytics platform to fund managers. The platform includes scores or opinions. The product is positioned for portfolio construction and monitoring, with outputs designed to be consumed in investment committee packs or portfolio reviews; and (d) a provider markets information about physical assets that includes an assessment of the asset’s exposure to physical climate hazards. The product is marketed to institutional investors to inform real estate investment decisions and portfolio risk analytics across holdings that own or use the assets in question. The product is being marketed for use in contexts where it would be likely to inform decisions to make a

FCA 2026/69
FOS 2026/7 specified investment, whether directly in real estate assets or more broadly across a portfolio of securities and other assets. (3) Products explicitly designed, marketed and used for other purposes, such as supply chain management, operational regulatory compliance or consumer purchasing choices unrelated to financial products or services, would generally not be considered likely to influence a decision to make a specified investment. In circumstances where an investor could theoretically access or view such a product, this would not automatically mean that the person providing the rating could reasonably have expected it to influence a decision to make a specified investment. (4) However, should a provider of such a product knowingly begin to market or distribute it or permit its use for purposes where the provider could reasonably expect it to influence a decision to make a specified investment, that activity is likely to amount to regulated activity. (5) The product in PERG 19.4.10(4) would likely fall outside the perimeter if it is marketed only to companies to assess their own operational exposure to physical climate hazards. (6) In assessing whether an ESG rating is likely to influence a decision to make a specified investment; the provider does not have to know the exact use of every ESG rating.
19.5 Territorial scope
19.5.1 Question 5.1: What is the territorial scope of the regime?
A provider needs FCA authorisation for providing an ESG rating if:
(1) it is a firm ‘located in the United Kingdom’ (whether it provides the ESG rating to a person who is in the UK or overseas); or (2) it is located overseas but provides an ESG rating to a person ‘located in the United Kingdom’ and is remunerated for it (by any person). See PERG 2.4.11G(2) regarding the meaning of ‘located in the United Kingdom’. A person located overseas is out of scope where it provides a rating into the UK for no remuneration (for example, by publishing on a free-to-access website). This is excluded by article 72(5G) of the Regulated Activities Order (Overseas persons). Article 72(5H) makes clear that remuneration in this context means:
‘any commission, fee, charge or other payment, including an economic benefit of any kind or any other financial or non-financial advantage or incentive offered or given.’

FCA 2026/69
FOS 2026/7
19.5.2 Question 5.2: I am distributing my ratings to UK users via an overseas
intermediary, so I am producing the rating but not making it available myself to anyone in the UK. Am I out of scope? No. Where a provider makes a rating available to one or more third parties outside the UK but reasonably expects it to be provided to a person in the UK, the activity is in scope of regulation (see the definition of ‘providing’ in article 63Z7 of the Regulated Activities Order).
19.6 Exclusions
19.6.1 Question 6.1: Which kinds of ESG ratings are excluded from regulation?
Exclusions are listed at PERG 2.8.14GG. Further guidance on selected exclusions is below.
19.6.2 Question 6.2: What is the purpose of the regulated products and services
exclusion?
If a firm produces ESG ratings in the course of carrying on another FCAregulated activity (or ancillary service) that it has permission for, it does not need a separate permission for providing an ESG rating. This exclusion also covers other activities that require a form of FCA-approval and certain other activities: providers will not need FCA authorisation if they are providing an ESG rating in the course of carrying on those activities (see PERG 19.6.3). The regulated products and services exclusion does not apply where a firm is also providing ESG ratings on a standalone basis (see PERG 19.6.8). This exclusion reduces the burden for firms that are already regulated by the FCA.
19.6.3 Question 6.3: Which kinds of activities are covered by the regulated
products and services exclusion?
This exclusion can apply to:
(1) FCA-authorised persons producing ESG ratings in the course of carrying on a regulated activity they already have permission for, or ancillary services set out in Part 3A of Schedule 2 of the Regulated Activities Order; (2) persons that are subject to another form of FCA approval (whether authorisation, registration or equivalent) under:
(a) assimilated law; or
(b) restated legislation (under section 4 of the Financial Services and Markets Act 2023);

FCA 2026/69
FOS 2026/7
(3) - persons carrying on activities under special arrangements for overseas providers (‘market access arrangements’ – see PERG 19.6.4); and (4) - persons carrying on an activity (such as marketing) in relation to:
(a) a recognised scheme (ie, a scheme recognised under section 272 of the Act, an OFR recognised scheme, or a scheme or subfund which is temporarily recognised under Part 6 of the Collective Investment Schemes (Amendment etc.) (EU Exit) Regulations 2019); or (b) an AIF which has been notified for marketing by a non-UK AIFM under either regulation 58 or regulation 59 of the AIFMD UK regulation.
19.6.4 Question 6.4: What market access arrangements are covered by the
regulated products and services exclusion?
The regulated products and services exclusion also covers ESG ratings used in the course of providing:
(1) credit ratings benefitting from equivalence (known as ‘certification’) under the CRA Regulation; (2) benchmarks benefitting from equivalence, recognition, endorsement or the third country regime transitional provisions under the benchmarks regulation; (3) a regulated activity that is carried on by an overseas person excluded under article 72 (Overseas persons) of the Regulated Activities Order; or (4) services provided by registered BFSA investment firms when exercising market access rights under Annex 5 of the Berne Financial Services Agreement.
19.6.5 Question 6.5: Are ESG ratings used in the production of credit ratings
within scope?
ESG ratings used in the course of carrying on the following activities are excluded from scope of regulation where they are not provided on a standalone basis (see PERG 19.6.8) and are used to produce, or are incorporated in:
(1) credit ratings (including endorsed credit ratings) issued by a credit rating agency registered under the CRA Regulation (article 63V(1)(b) of the Regulated Activities Order); (2) credit ratings issued by a certified credit rating agency (article 63V(3)(a) of the Regulated Activities Order); or

FCA 2026/69
FOS 2026/7
(3) unregulated credit ratings (article 63X of the Regulated Activities Order).
19.6.6 Question 6.6: Are ESG ratings used in the production of benchmarks
within scope?
ESG ratings used in the course of carrying on the following activities are excluded from scope where they are not provided on a standalone basis (see PERG 19.6.8)) and are used to produce, or are incorporated in:
(1) benchmarks provided by authorised benchmark administrators under the benchmarks regulation (article 63V(1)(b) of the Regulated Activities Order); (2) benchmarks provided under equivalence, recognition or endorsement arrangements (article 63V(3)(b)(i)(aa) to (cc) of the Regulated Activities Order); (3) benchmarks provided under the transitional regime (article 63V(3)(b)(ii) of the Regulated Activities Order); or (4) benchmarks excluded from the scope of the benchmarks regulation (article 63W of the Regulated Activities Order).
19.6.7 Question 6.7: Are ESG ratings incorporated in investment research
covered by the regulated products and services exclusion?
Yes, to the extent that investment research is provided by a firm with permission for advising on investments, or as a MiFID ancillary service and the ESG rating is not provided on a standalone basis (see PERG 19.6.8), the exclusion applies (article 63V(1)(a)(i) or (ii) of the Regulated Activities Order). If a person providing investment research or financial analysis does not have a
Part 4A permission covered by article 63V(1)(a)(i) or (ii) of the Regulated
Activities Order, it cannot rely on the regulated products and services exclusion. It is therefore likely to need permission to provide an ESG rating where its research or analysis includes or amounts to an in-scope ESG rating, if no other exclusion applies to its business.
19.6.8 Question 6.8: Some of the exclusions do not apply where an activity is
provided as a standalone product or service. What does this mean? The exclusion does not apply if the ESG rating is provided to users as a standalone product or service, separate from the firm’s other regulated products and services. For example:
(1) An unauthorised person providing an ESG rating for the purpose of marketing a recognised scheme (for example, the operator of an OFR recognised scheme) would benefit from the exclusion. But a person who publishes or supplies an ESG rating completely separately from their investment services would not.

FCA 2026/69
FOS 2026/7
(2) A benchmark administrator using ESG ratings to create a benchmark would be able to benefit from the exclusion. However, if an ESG rating is separately commissioned from the benchmark administrator by a rated item or distributed by subscription, this would amount to ‘standalone’ provision, and the exclusion would not apply. (3) An investment firm’s inclusion of an ESG rating within investment research provided as part of its activity advising on investments, or as an ancillary service would benefit from the exclusion. However, where an investment firm publishes or supplies ESG ratings separately to its investment services or ancillary services, it will be providing the ESG rating as a ‘standalone’ product or service, so the exclusion will not apply. (4) A fund manager with UK clients produces in-house ratings using a mix of data and ratings from multiple providers. The methodology is its own. These ratings are used to construct, manage and market the fund manager’s own product offerings. They are also used in the management of separately managed accounts for the fund manager’s clients. The ratings are not available for independent use outside the fund manager or for use that is separate from its investment product and service offerings. This activity would likely benefit from the regulated products and services exclusion. In contrast, the activity would likely require permission for providing an ESG rating if, for example, in addition to the internal use, the fund manager also distributed the ratings separately through a third-party financial data platform whose users could access the ratings independently and use them for their own purposes.
19.6.9 Question 6.9: I am a journalist, academic or work in the charities sector
and the assessments I produce as part of that work seem to come within scope of the regulated activity of providing ESG ratings. Do I need to seek authorisation? Journalists, academics and charities may rely on the exclusion under article 63Z1 of the Regulated Activities Order (ancillary non-commercial provision) if they meet certain conditions. They must either:
(1) receive no relevant remuneration; or
(2) provide the rating on an occasional or one-off basis (a condition that will not be met where the ESG rating is regularly updated or undergoes ongoing maintenance). ‘Relevant remuneration’ means ‘any commission, fee, charge or other payment, including an economic benefit of any kind or any other financial advantage or incentive offered’ (article 63Z1 Regulated Activities Order).

FCA 2026/69
FOS 2026/7
[Note: This differs from the meaning that applies to overseas providers of ESG ratings under article 72 (Overseas persons) of the Regulated Activities Order (see PERG 2.8.14GG(11)) and PERG 19.5.1.] An example of where the exclusion would not apply would be if a team of academics produced a report ranking company progress on transitioning to net zero, but where the work was funded by subscriptions from financial services firms who then use the ratings. By contrast, a media outlet providing a one-off ranking (for example, ‘top 100 companies by workforce satisfaction’) would not be in scope. When assessing remuneration, the FCA will consider all the relevant facts and look at the group structure and organisation holistically.
19.6.10 Question 6.10: What does the exclusion for regulatory or legal
requirements cover?
An ESG rating produced solely to comply with a legal or regulatory requirement may be excluded (under article 63Z4 of the Regulated Activities Order). The exclusion will only apply if:
(1) the sole purpose of the rating is to comply with a regulatory or legal requirement; (2) the requirement is imposed by law; and (3) the person producing the rating is the person subject to that requirement. A third-party rating for these purposes is not covered by the exclusion.
19.6.11 Question 6.11: Is our advice on ESG to pension schemes in scope?
As noted above, specified investment has a broad definition. It also includes rights under a personal pension plan. Providing an ESG rating in relation to any specified investment would likely amount to influencing a decision to make a specified investment. If ESG advice in relation to rights under a personal pension scheme amounts to, or includes, an ESG rating, the persons giving that advice will need permission for providing an ESG rating. Rights under an occupational pension scheme are not generally specified investments (though there are some exceptions). However, where firms advise on the specified investments that are being proposed or provided to occupational scheme trustees (which are then used to support the benefits being provided under the scheme) and where that advice includes an ESG rating, the firm will need to consider seeking permission to provide an ESG rating.

FCA 2026/69
FOS 2026/7
19.6.12 Question 6.12: How might the private use exclusion apply?
An example of where the private use exclusion might apply would be where a provider produces ESG ratings on privately held companies. These companies commission ratings on themselves, and the provider sells the rating directly to the commissioning firm. The terms of the contract only permit the commissioning firm to use the rating internally (for example, to understand how potential investors or lenders might view its sustainability risk profile). In contrast, if the ESG ratings were marketed to firms as a tool to use in financing applications or communications to potential investors, or the provider could reasonably expect that the rated firm would use its rating in such a way, the activity would likely require authorisation. Equally, if the ratings were marketed, for example, to banks that commission the ratings for firms where they are considering underwriting an IPO, this activity would also be likely to require authorisation.
19.7 Exemption
19.7.1 Question 7.1: We offer FCA-regulated services under Part XX of the Act.
Do we need FCA-authorisation and permission to offer ESG ratings? Persons that are members of certain designated professional bodies (DPBs) under Part XX of the Act, and that comply with standards set by their DPB, are exempt from the need to become FCA-authorised. The DPB exemption applies only if the relevant DPB has made rules covering the activity and the FCA has approved those rules. For example, if investment consultants are members of a DPB and wish to provide ESG ratings without FCA authorisation, their DPB would need to make FCA-approved rules covering ESG ratings and the firms would need to comply with them.

© Financial Conduct Authority 2026
12 Endeavour Square London E20 1JN
Telephone: +44 (0)20 7066 1000
Website: www.fca.org.uk
All rights reserved
Pub ref: 2‑009080
All our publications are available to download from www.fca.org.uk. Request an alternative format Please complete this form if you require this content in an alternative format. Or call 0207 066 6087 Sign up for our news and publications alerts

Lineage: No known changes

Timeline

Similar documents from other regulators